Description
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Xchange | OX Dovecot Pro | ≤ 3.1.4, ≤ 2.4.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:2.4.4+dfsg1-1 | — |
| Debian 13 | dovecot | 1:2.4.1+dfsg1-6+deb13u6 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | dovecot | 1:2.4.2+dfsg1-3ubuntu2.1 | — |
| Ubuntu 25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.2 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | dovecot24 | 2.4.4-160000.1.1 | SUSE-SU-2026:22185-1 |
| SLES 16.0 | dovecot24 | 2.4.4-160000.1.1 | SUSE-SU-2026:22185-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dovecot24 | 2.4.4-1.1 | openSUSE-SU-2026:10766-1 |
| openSUSE Leap 16.0 | dovecot24 | 2.4.4-160000.1.1 | openSUSE-SU-2026:21109-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dovecot | 2.4.4-r0 | — |
| Alpine v3.23 | dovecot | 2.4.4-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | dovecot | No fix yet | — |
Advisories 4
- WID-SEC-2026-1510 OX Dovecot Pro: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 21, 2026
- openSUSE-SU-2026:21109-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:22185-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:10766-1 dovecot24-2.4.4-1.1 on GA media SUSE / openSUSE Security Updates · May 14, 2026