Description
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Xchange | OX Dovecot Pro | ≤ 3.1.0, ≤ 2.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:2.4.3+dfsg1-1 | — |
| Debian 13 | dovecot | 1:2.4.1+dfsg1-6+deb13u4 | — |
| Debian 12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.1 | — |
| Ubuntu 24.04 LTS | dovecot | 1:2.3.21+dfsg1-2ubuntu6.3 | — |
| Ubuntu 22.04 LTS | dovecot | 1:2.3.16+dfsg1-3ubuntu2.7 | — |
| Ubuntu 20.04 LTS | dovecot | No fix yet | — |
| Ubuntu 18.04 LTS | dovecot | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | dovecot | No fix yet | — |
| Ubuntu Pro 14.04 LTS | dovecot | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | dovecot +4 | 1:2.3.21-16.el10_1.1 | RHSA-2026:19149, RHSA-2026:13498 |
| RHEL 9 | dovecot +4 | 1:2.3.16-15.el9_7.1 | RHSA-2026:19364, RHSA-2026:13857 |
| RHEL 8 | dovecot +4 | 1:2.3.16-7.el8_10 | RHSA-2026:13830 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | dovecot +4 | 1:2.3.21-16.el10_0.1 | RHSA-2026:17602 |
| RHEL 9.6 EUS | dovecot +4 | 1:2.3.16-15.el9_6.1 | RHSA-2026:17626 |
| RHEL 9.4 EUS | dovecot +4 | 1:2.3.16-11.el9_4.2 | RHSA-2026:17625 |
| RHEL 9.2 E4S | dovecot +3 | 1:2.3.16-8.el9_2.2 | RHSA-2026:17628 |
| RHEL 9.0 E4S | dovecot +3 | 1:2.3.16-3.el9_0.1 | RHSA-2026:17630 |
| RHEL 8.8 TUS | dovecot +3 | 1:2.3.16-3.el8_8.1 | RHSA-2026:18053 |
| RHEL 8.8 E4S | dovecot +3 | 1:2.3.16-3.el8_8.1 | RHSA-2026:18053 |
| RHEL 8.6 TUS | dovecot +3 | 1:2.3.16-2.el8_6.1 | RHSA-2026:19453 |
| RHEL 8.6 E4S | dovecot +3 | 1:2.3.16-2.el8_6.1 | RHSA-2026:19453 |
| RHEL 8.6 AUS | dovecot +3 | 1:2.3.16-2.el8_6.1 | RHSA-2026:19453 |
| RHEL 8.4 EUS Long Life | dovecot +3 | 1:2.3.8-9.el8_4.1 | RHSA-2026:19455 |
| RHEL 8.4 AUS | dovecot +3 | 1:2.3.8-9.el8_4.1 | RHSA-2026:19455 |
| RHEL 7 ELS | dovecot +4 | 1:2.2.36-8.el7_9.1 | RHSA-2026:26564 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | dovecot +4 | 1:2.3.21-16.el10_1.1 | ALSA-2026:19149, ALSA-2026:13498 |
| AlmaLinux 9 | dovecot +4 | 1:2.3.16-15.el9_7.1 | ALSA-2026:19364, ALSA-2026:13857 |
| AlmaLinux 8 | dovecot +4 | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | dovecot | 1:2.3.21-16.el10_1.1 | RLSA-2026:19149, RLSA-2026:13498 |
| Rocky Linux 9 | dovecot | 1:2.3.16-15.el9_7.1 | RLSA-2026:19364, RLSA-2026:13857 |
| Rocky Linux 8 | dovecot | 1:2.3.16-7.el8_10 | RLSA-2026:13830 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 15 SP6 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 15 SP5 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 15 SP4 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | dovecot24 | 2.4.3-160000.1.1 | SUSE-SU-2026:21208-1 |
| SLES for SAP 15 SP6 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES for SAP 15 SP5 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES for SAP 15 SP4 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 16.0 | dovecot24 | 2.4.3-160000.1.1 | SUSE-SU-2026:21208-1 |
| SLE HPC 15 SP5 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLE HPC 15 SP4 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dovecot24 | 2.4.3-1.1 | openSUSE-SU-2026:10442-1 |
| openSUSE Leap 16.0 | dovecot24 | 2.4.3-160000.1.1 | openSUSE-SU-2026:20554-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | dovecot | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | dovecot +4 | 1:2.3.21-16.el10_1.1 | ELSA-2026-19149, ELSA-2026-13498 |
| Oracle Linux 9 | dovecot +4 | 1:2.3.16-15.el9_7.1 | ELSA-2026-19364, ELSA-2026-13857 |
| Oracle Linux 8 | dovecot +4 | 1:2.3.16-7.el8_10 | ELSA-2026-13830 |
| Oracle Linux 7 | dovecot +4 | 1:2.2.36-8.el7 | ELSA-2026-26564 |
Advisories 35
- ALSA-2026:13498 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19364 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:13857 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19149 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:13830 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- SUSE-SU-2026:4139-1 Security update for dovecot23 SUSE / openSUSE Security Updates · Sep 28, 2026
- WID-SEC-2026-0891 Dovecot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 16, 2026
- ELSA-2026-26564 Important: dovecot security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 10, 2026
- ELSA-2026-19149 Important: dovecot security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- RHSA-2026:26564 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:19455 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:19453 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:19364 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:19149 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:18053 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17628 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17630 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17625 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17626 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17602 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:13857 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:13830 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:13498 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- ELSA-2026-19364 Important: dovecot security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- RLSA-2026:19149 Important: dovecot security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:19364 Important: dovecot security update Rocky Linux Security Advisories · May 28, 2026
- RLSA-2026:13857 Important: dovecot security update Rocky Linux Security Advisories · May 7, 2026
- RLSA-2026:13830 Important: dovecot security update Rocky Linux Security Advisories · May 7, 2026
- RLSA-2026:13498 Important: dovecot security update Rocky Linux Security Advisories · May 6, 2026
- ELSA-2026-13857 Important: dovecot security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 6, 2026
- ELSA-2026-13830 Important: dovecot security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 6, 2026
- ELSA-2026-13498 Important: dovecot security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · May 5, 2026
- openSUSE-SU-2026:20554-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21208-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Apr 22, 2026
- openSUSE-SU-2026:10442-1 dovecot24-2.4.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 28, 2026