Description
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Install fixed version, there is no other remediation. No publicly available exploits are known.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Xchange | OX Dovecot Pro | ≤ 2.3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:2.4.3+dfsg1-1 | — |
| Debian 13 | dovecot | 1:2.4.1+dfsg1-6+deb13u4 | — |
| Debian 12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.1 | — |
| Ubuntu 24.04 LTS | dovecot | 1:2.3.21+dfsg1-2ubuntu6.3 | — |
| Ubuntu 22.04 LTS | dovecot | 1:2.3.16+dfsg1-3ubuntu2.7 | — |
| Ubuntu 20.04 LTS | dovecot | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | dovecot +4 | 1:2.3.21-16.el10_1.1 | RHSA-2026:19149, RHSA-2026:13498 |
| RHEL 9 | dovecot +4 | 1:2.3.16-15.el9_7.1 | RHSA-2026:19364, RHSA-2026:13857 |
| RHEL 8 | dovecot +4 | 1:2.3.16-7.el8_10 | RHSA-2026:13830 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | dovecot +4 | 1:2.3.21-16.el10_0.1 | RHSA-2026:17602 |
| RHEL 9.6 EUS | dovecot +4 | 1:2.3.16-15.el9_6.1 | RHSA-2026:17626 |
| RHEL 9.4 EUS | dovecot +4 | 1:2.3.16-11.el9_4.2 | RHSA-2026:17625 |
| RHEL 9.2 E4S | dovecot +3 | 1:2.3.16-8.el9_2.2 | RHSA-2026:17628 |
| RHEL 9.0 E4S | dovecot +3 | 1:2.3.16-3.el9_0.1 | RHSA-2026:17630 |
| RHEL 8.8 TUS | dovecot +3 | 1:2.3.16-3.el8_8.1 | RHSA-2026:18053 |
| RHEL 8.8 E4S | dovecot +3 | 1:2.3.16-3.el8_8.1 | RHSA-2026:18053 |
| RHEL 8.6 TUS | dovecot +3 | 1:2.3.16-2.el8_6.1 | RHSA-2026:19453 |
| RHEL 8.6 E4S | dovecot +3 | 1:2.3.16-2.el8_6.1 | RHSA-2026:19453 |
| RHEL 8.6 AUS | dovecot +3 | 1:2.3.16-2.el8_6.1 | RHSA-2026:19453 |
| RHEL 8.4 EUS Long Life | dovecot +3 | 1:2.3.8-9.el8_4.1 | RHSA-2026:19455 |
| RHEL 8.4 AUS | dovecot +3 | 1:2.3.8-9.el8_4.1 | RHSA-2026:19455 |
| RHEL 7 ELS | dovecot +4 | 1:2.2.36-8.el7_9.1 | RHSA-2026:26564 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | dovecot +4 | 1:2.3.21-16.el10_1.1 | ALSA-2026:19149, ALSA-2026:13498 |
| AlmaLinux 9 | dovecot +4 | 1:2.3.16-15.el9_7.1 | ALSA-2026:19364, ALSA-2026:13857 |
| AlmaLinux 8 | dovecot +4 | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | dovecot | 1:2.3.21-16.el10_1.1 | RLSA-2026:19149, RLSA-2026:13498 |
| Rocky Linux 9 | dovecot | 1:2.3.16-15.el9_7.1 | RLSA-2026:19364, RLSA-2026:13857 |
| Rocky Linux 8 | dovecot | 1:2.3.16-7.el8_10 | RLSA-2026:13830 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 15 SP6 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 15 SP5 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 15 SP4 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | dovecot24 | 2.4.3-160000.1.1 | SUSE-SU-2026:21208-1 |
| SLES for SAP 15 SP6 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES for SAP 15 SP5 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES for SAP 15 SP4 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 16.0 | dovecot24 | 2.4.3-160000.1.1 | SUSE-SU-2026:21208-1 |
| SLE HPC 15 SP5 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLE HPC 15 SP4 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dovecot24 | 2.4.3-1.1 | openSUSE-SU-2026:10442-1 |
| openSUSE Leap 16.0 | dovecot24 | 2.4.3-160000.1.1 | openSUSE-SU-2026:20554-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dovecot | 2.4.3-r0 | — |
| Alpine v3.23 | dovecot | 2.4.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | dovecot +4 | 1:2.3.20-1.amzn2023.0.3 | ALAS2023-2026-1570 |
| Amazon Linux 2 | dovecot +4 | 1:2.2.36-6.amzn2.1.3 | ALAS2-2026-3252 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | dovecot | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | dovecot +4 | 1:2.3.21-16.el10_1.1 | ELSA-2026-19149, ELSA-2026-13498 |
| Oracle Linux 9 | dovecot +4 | 1:2.3.16-15.el9_7.1 | ELSA-2026-19364, ELSA-2026-13857 |
| Oracle Linux 8 | dovecot +4 | 1:2.3.16-7.el8_10 | ELSA-2026-13830 |
| Oracle Linux 7 | dovecot +4 | 1:2.2.36-8.el7 | ELSA-2026-26564 |
Advisories 37
- ALSA-2026:13498 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19364 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:13857 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19149 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:13830 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- SUSE-SU-2026:4139-1 Security update for dovecot23 SUSE / openSUSE Security Updates · Sep 28, 2026
- WID-SEC-2026-0891 Dovecot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 16, 2026
- ELSA-2026-26564 Important: dovecot security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 10, 2026
- ELSA-2026-19149 Important: dovecot security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- RHSA-2026:26564 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:19455 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:19453 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:19364 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:19149 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:18053 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17628 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17630 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17625 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17626 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:17602 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:13857 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:13830 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:13498 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- ELSA-2026-19364 Important: dovecot security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- RLSA-2026:19149 Important: dovecot security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:19364 Important: dovecot security update Rocky Linux Security Advisories · May 28, 2026
- RLSA-2026:13857 Important: dovecot security update Rocky Linux Security Advisories · May 7, 2026
- RLSA-2026:13830 Important: dovecot security update Rocky Linux Security Advisories · May 7, 2026
- RLSA-2026:13498 Important: dovecot security update Rocky Linux Security Advisories · May 6, 2026
- ELSA-2026-13857 Important: dovecot security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 6, 2026
- ELSA-2026-13830 Important: dovecot security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 6, 2026
- ELSA-2026-13498 Important: dovecot security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · May 5, 2026
- ALAS2-2026-3252 Important: dovecot security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 29, 2026
- openSUSE-SU-2026:20554-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21208-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Apr 22, 2026
- ALAS2023-2026-1570 Important: dovecot security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
- openSUSE-SU-2026:10442-1 dovecot24-2.4.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 28, 2026