- dovecot - dovecot.org

Problem with setup of 2.4
by Doug Hardie 02 Sep '26

02 Sep '26

I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server: master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet Connecting to 10.0.1.230 Can't use SSL_get_servername depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2 verify return:1 depth=2 C=US, O=ISRG, CN=Root YE verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YE2 verify return:1 depth=0 CN=mail.sermon-archive.info verify return:1 . OK Pre-login capabilities listed, post-login capabilities have more. At that point I can login and view mail. However, if i use the same command on the test server: master# openssl s_client -connect 10.0.1.235:993 -starttls imap Connecting to 10.0.1.235 CONNECTED(00000003) At this point is sits there accepting no input. The log shows: Aug 31 13:56:22 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [6]: Server accepted connection (fd=21) Aug 31 13:56:22 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [6]: auth client connected (pid=86045) There appears to be an SSL issue. The same certificates are used on both servers. Both servers are running FreeBSD 15.1. dovecot.conf is: test# cat dovecot.conf # Conversion performed at 2026-08-23 05:06:46.587238 dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.0 auth_mechanisms = plain cram-md5 auth_verbose_passwords = no base_dir = /var/run/home_mail/ first_valid_gid = 0 imap_capability = SASL-IR LOGIN-REFERRALS ID ENABLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5 lda_mailbox_autocreate = yes login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} %{ssl_security} session=<%{session}> port=%{local_port} mail_driver = maildir mail_gid = 2222 mail_home = /var/mail/home_mail/%{user | username} mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from mail_log_prefix = %{protocol}(%{user})[%{remote_ip}]<%{session}>: mail_path = Maildir mail_temp_scan_interval = 0 mail_uid = 2222 postmaster_address = doug(a)sermon-archive.info protocols = imap syslog_facility = local1 verbose_proctitle = yes namespace inbox { inbox = yes mailbox Drafts { autoexpunge = 5 days special_use = \Drafts } mailbox Junk { autoexpunge = 5 days special_use = \Junk } mailbox Trash { autoexpunge = 50 days special_use = \Trash } mailbox Sent { autoexpunge = 30 days special_use = \Sent } mailbox "Sent Messages" { autoexpunge = 30 days special_use = \Sent } } passdb passwd-file { auth_username_format = %{user | username} default_password_scheme = CRYPT driver = passwd-file passwd_file_path = /usr/local/etc/dovecot/users } userdb static { driver = static fields { allow_all_users = yes home = /var/mail/home_mail/%d/%n } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } inet_listener imaps2 { port = 998 ssl = yes } } service auth { unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_server { cert_file = /www/certs/mail.pem dh_file = /usr/local/etc/dovecot/dh.pem key_file = # hidden, use -P to show it } protocol lda { mail_plugins { sieve = yes } } protocol imap { imap_metadata = yes mail_plugins { mail_log = yes notify = yes } } protocol pop3 { mail_plugins { mail_log = yes notify = yes } } #sieve_script personal { # active_path = /var/mail/home_mail/%{user | username}/.dovecot.sieve # driver = file # path = /var/mail/home_mail/%{user | username}/sieve #} mail_attribute { dict file { path = %{home}/Maildir/dovecot-attributes } } # Warnings during conversion: # - <memory>:8: dropping removed setting 'auth_stats' # - <memory>:50: mail_plugins uses $SET:mail_plugins but adds nothing # - <memory>:180: no converter for 'plugin/@1/stats_refresh' # - <memory>:181: no converter for 'plugin/@1/stats_track_cmds' # - pruned default: inbox prefix = '' log_debug = category=auth -- Doug

2 4

Dovecot 2.4: shared mailboxes not working - maybe related to mail_path
by Markus Schönhaber 02 Sep '26

02 Sep '26

Hi, I've had a hard time trying to upgrade my dovecot 2.3 setup to v. 2.4 (debian 13, Dovecot installed from repo.dovecot.org) One thing I still haven't got to work is mailbox sharing. I have configured this (full doveconf -n output attached): mail_driver = mdbox mail_home = /var/spool/vmail/home/%{user | domain}/%{user | username} mail_path = /var/spool/vmail/mail/%{user | domain}/%{user | username} mail_plugins = quota acl namespace inbox { inbox = yes separator = / } namespace shared { mail_home = /var/spool/vmail/home/%{owner_domain}/%{owner_username} list = children prefix = shared/$domain/$username/ separator = / subscriptions = no type = shared } acl_driver = vfile mail_plugins { acl = yes } protocol imap { mail_plugins { imap_acl = yes } } acl_sharing_map { dict file { path = /var/spool/vmail/home/shared-mailboxes } } Now, given two users: 1: sharing-user(a)example.com 2: sharing-client(a)example.net User 1 wants to share his mailbox "4you" to user 2 by setting these acls: > # doveadm acl add -u sharing-user(a)example.com 4you user=sharing-client(a)example.net lookup read write-seen But the shared mailbox isn't visible for user 2 (in fact, not even the namespace is, since list = children). acl debug shows this: > # doveadm acl debug -u sharing-client(a)example.net shared/example.com/sharing-user/4you > doveadm(sharing-client(a)example.net): Error: Mailbox shared/example.com/sharing-user/4you: Mailbox '4you' in namespace shared doesn't exist in /var/spool/vmail/mail/example.net/sharing-client/mailboxes/4you/dbox-Mails So the shared mailbox is looked for in user 2's mail_path, not in user 1's, who shares it and where the mailbox actually resides. So, I tried and set mail_path = /var/spool/vmail/path/%{owner_domain}/%{owner_username} for the shared namespace. This does not only seem reasonable but also is mentioned in the second config example here: https://doc.dovecot.org/2.4.4/core/config/shared_mailboxes.html#user-shared… But that doesn't help. Instead I get: > # doveadm acl debug -u sharing-client(a)example.net shared/example.com/sharing-user/4you > doveadm(sharing-client(a)example.net): Error: Namespace shared: mail_storage settings: Failed to parse configuration: Failed to expand mail_path setting variables: Unknown variable 'owner_domain' > doveadm(sharing-client(a)example.net): Error: Namespace shared: mail_storage settings: Failed to parse configuration: Failed to expand mail_path setting variables: Unknown variable 'owner_domain' > doveadm(sharing-client(a)example.net): Error: Namespace shared: mail_storage settings: Failed to parse configuration: Failed to expand mail_path setting variables: Unknown variable 'owner_domain' > doveadm(sharing-client(a)example.net): Error: Mailbox shared/example.com/sharing-user/4you: Can't open mailbox shared/example.com/sharing-user/4you: Internal error occurred. Refer to server log for more information. [2026-08-20 14:53:40] Swapping %{owner_domain} and %{owner_username} in the config above, I get Unknown variable 'owner_username' as error. If I set mail_path = /var/spool/vmail/mail/example.com/sharing-user i. e. I hard-code the sharing user's mail_path, sharing works for this particular user. But that won't help if a second user wants to share mailboxes too. > # doveadm acl debug -u sharing-client(a)example.net shared/example.com/sharing-user/4you > doveadm(sharing-client(a)example.net): Info: Mailbox shared/example.com/sharing-user/4you: Mailbox '4you' is in namespace shared > doveadm(sharing-client(a)example.net): Info: Mailbox shared/example.com/sharing-user/4you: Mailbox path: /var/spool/vmail/mail/example.com/sharing-user/mailboxes/4you/dbox-Mails > doveadm(sharing-client(a)example.net): Info: Mailbox shared/example.com/sharing-user/4you: All message flags are shared across users in mailbox > doveadm(sharing-client(a)example.net): Info: Mailbox shared/example.com/sharing-user/4you: User sharing-client(a)example.net has rights: lookup read write-seen > doveadm(sharing-client(a)example.net): Info: Mailbox shared/example.com/sharing-user/4you: Mailbox found from dovecot-acl-list > doveadm(sharing-client(a)example.net): Info: Mailbox shared/example.com/sharing-user/4you: User sharing-user(a)example.com found from ACL shared dict > doveadm(sharing-client(a)example.net): Info: Mailbox shared/example.com/sharing-user/4you: Mailbox shared/example.com/sharing-user/4you is visible in LIST What am I doing wrong? How to do ist right? -- Regards mks

3 6

Problem with setup of 2.4
by Doug Hardie 01 Sep '26

01 Sep '26

I have a production 2.3 server on the machine named "mail". I have installed 2.4 on the server named "test". I used the configuration converter to convert the production configuration to the new configuration structure. I did add a "log_debug = category=auth" line at the end for debug info. If I use the command to the production server: master# openssl s_client -connect 10.0.1.230:imap -starttls imap -quiet Connecting to 10.0.1.230 Can't use SSL_get_servername depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2 verify return:1 depth=2 C=US, O=ISRG, CN=Root YE verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YE2 verify return:1 depth=0 CN=mail.sermon-archive.info verify return:1 . OK Pre-login capabilities listed, post-login capabilities have more. At that point I can login and view mail. However, if i use the same command on the test server: master# openssl s_client -connect 10.0.1.235:993 -starttls imap Connecting to 10.0.1.235 CONNECTED(00000003) At this point is sits there accepting no input. The log shows: Aug 31 13:56:22 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [6]: Server accepted connection (fd=21) Aug 31 13:56:22 test dovecot[85915]: auth: Debug: conn unix:login (uid=144) [6]: auth client connected (pid=86045) There appears to be an SSL issue. The same certificates are used on both servers. Both servers are running FreeBSD 15.1. dovecot.conf is: test# cat dovecot.conf # Conversion performed at 2026-08-23 05:06:46.587238 dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.0 auth_mechanisms = plain cram-md5 auth_verbose_passwords = no base_dir = /var/run/home_mail/ first_valid_gid = 0 imap_capability = SASL-IR LOGIN-REFERRALS ID ENABLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5 lda_mailbox_autocreate = yes login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} %{ssl_security} session=<%{session}> port=%{local_port} mail_driver = maildir mail_gid = 2222 mail_home = /var/mail/home_mail/%{user | username} mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from mail_log_prefix = %{protocol}(%{user})[%{remote_ip}]<%{session}>: mail_path = Maildir mail_temp_scan_interval = 0 mail_uid = 2222 postmaster_address = doug(a)sermon-archive.info protocols = imap syslog_facility = local1 verbose_proctitle = yes namespace inbox { inbox = yes mailbox Drafts { autoexpunge = 5 days special_use = \Drafts } mailbox Junk { autoexpunge = 5 days special_use = \Junk } mailbox Trash { autoexpunge = 50 days special_use = \Trash } mailbox Sent { autoexpunge = 30 days special_use = \Sent } mailbox "Sent Messages" { autoexpunge = 30 days special_use = \Sent } } passdb passwd-file { auth_username_format = %{user | username} default_password_scheme = CRYPT driver = passwd-file passwd_file_path = /usr/local/etc/dovecot/users } userdb static { driver = static fields { allow_all_users = yes home = /var/mail/home_mail/%d/%n } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } inet_listener imaps2 { port = 998 ssl = yes } } service auth { unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_server { cert_file = /www/certs/mail.pem dh_file = /usr/local/etc/dovecot/dh.pem key_file = # hidden, use -P to show it } protocol lda { mail_plugins { sieve = yes } } protocol imap { imap_metadata = yes mail_plugins { mail_log = yes notify = yes } } protocol pop3 { mail_plugins { mail_log = yes notify = yes } } #sieve_script personal { # active_path = /var/mail/home_mail/%{user | username}/.dovecot.sieve # driver = file # path = /var/mail/home_mail/%{user | username}/sieve #} mail_attribute { dict file { path = %{home}/Maildir/dovecot-attributes } } # Warnings during conversion: # - <memory>:8: dropping removed setting 'auth_stats' # - <memory>:50: mail_plugins uses $SET:mail_plugins but adds nothing # - <memory>:180: no converter for 'plugin/@1/stats_refresh' # - <memory>:181: no converter for 'plugin/@1/stats_track_cmds' # - pruned default: inbox prefix = '' log_debug = category=auth -- Doug -- Doug

1 0

global ACL file with Dovecot >=2.4.3
by Markus Schönhaber 31 Aug '26

31 Aug '26

Hi, https://doc.dovecot.org/2.4.5/core/plugins/acl.html#acl_global_path says that the acl_global_path config setting was removed with Dovecot 2.4.3 and one should use acl instead. But it does not explain how the new config setting should look like. The documentation further down on the page didn't help me to get the idea. While here https://doc.dovecot.org/2.4.5/core/plugins/acl.html#global-acl-file it is said that the > Global ACL file path is specified as a parameter to vfile driver in > |acl > <https://doc.dovecot.org/2.4.5/core/summaries/settings.html#acl>|, > |/etc/dovecot/dovecot-acl| in the above example. I don't see what the "above example" exactly refers to. In fact, the string "|/etc/dovecot/dovecot-acl" doesn't appear a second time on this page. Can someone give an example, how to configure a global ACL file for Dovecot >=2.4.3? -- Regards mks |

2 4

Dovecot 2.4.1 on DietPi/ARM64: Cannot move/delete any folders via IMAP, and three specific folders are unreadable (but other folders work)
by rdorau＠gmx.de 31 Aug '26

31 Aug '26

Hello, I'm running Dovecot 2.4.1 on a Raspberry Pi 4 with DietPi (Debian 13, ARM64) and had to migrate from another OS with Dovecot 2.3. My maildir is at /var/mail/mailuser. It contains many dot‑prefixed subfolders, e.g. .Archiv, .Archiv.Reisen, .Sozio. Relevant parts from doveconf -n: text dovecot_config_version = 2.4.0 auth_mechanisms = plain login dovecot_storage_version = 2.4.0 listen = * login_trusted_networks = 192.168.178.0/24 mail_driver = maildir mail_home = /var/mail/%u mail_path = /var/mail/%u protocols = imap ssl = no passdb pam { driver = pam } userdb passwd { driver = passwd } namespace inbox { inbox = yes prefix = separator = . } Problem 1: Cannot move, delete, or rename any folder via IMAP. In Thunderbird, I can move individual messages between folders, but I cannot move, rename, or delete any folder itself. This affects all folders, not just specific ones. Right‑clicking a folder and choosing “Delete”, “Rename”, or dragging a folder to another location does nothing – no error, just no effect. I have checked permissions on the maildir; mailuser owns the directories and files, and dovecot is in the mailuser group. Problem 2: Three specific folders cannot be opened (message body not loaded). Most of my archive works fine. But exactly these three folders fail: .Archiv.merk.Versicherungen.Axa (Reiserücktritt) .Archiv.merk.Versicherungen.Bavaria_Haftpflicht .Archiv.merk.Versicherungen.LVM_Auslandsreisekrankenversicherung In Thunderbird, I see the message headers, but when I try to open a message, the body stays empty. On the server, the files are intact – head shows the full header, and the messages are readable as plain files. Other folders with similar special characters (e.g. &APw-, &AOQ-, &ANY-) work without problems. So I don't think the special characters are the cause. Problem 3: doveadm mailbox list shows only INBOX and Trash. Even though the maildir contains many dot‑prefixed subfolders, doveadm mailbox list -u mailuser returns only: text Trash INBOX In Thunderbird, the subfolders appear inside INBOX (e.g. INBOX.Archiv, INBOX.Archiv.Reisen), which is basically correct. But doveadm does not list them as separate mailboxes. What I have already tried (without success): Renaming the three problematic folders to simple names (e.g. Axa_Reiseruecktritt) and creating new folders with the copied mails. Deleting Dovecot index files (dovecot.index*, dovecot-uidlist, subscriptions) and restarting Dovecot. Changing namespace separator and prefix settings. Adding dovecot to mailuser group and adjusting permissions (chmod 750). Forcing Thunderbird to re‑synchronize by deleting local .msf files – after that, the three folders sometimes disappear or become empty in Thunderbird, but the mail files remain on disk. None of this made doveadm mailbox list show the subfolders, and the three folders remain unreadable. My questions: Why does doveadm mailbox list not show the subfolders, even though they exist as dot‑prefixed directories and Thunderbird displays them? What do I need to change so that Dovecot lists them properly? Why can I not move, delete, or rename any folder via IMAP, even though moving messages works? Is this a configuration issue (e.g. missing ACL, wrong permissions, or something with the namespace)? How can I make the three unreadable folders readable again? What is the safest way to rebuild their indexes or re‑create them so that Thunderbird can open the messages? If the folder names are problematic (e.g., due to length or special characters), what is the correct way to rename them in the maildir structure so that Dovecot and Thunderbird can handle them normally? I need a method that preserves the existing mails and the folder hierarchy. I would be very grateful for any hints, because I'm stuck and have already spent many hours on this. Thank you in advance.

3 4

NFC normalization rename errors after 2.3 to 2.4 upgrade (mdbox)
by Jan Münnich 29 Aug '26

29 Aug '26

Hi, We just upgraded from 2.3 to 2.4.3 and are now getting errors like this for any mailbox with German umlauts in the name: "Error: Failed to rename mailbox 'Anträge' for NFC normalization: Mailbox doesn't exist: Anträge" The mailboxes work fine otherwise, doveadm mailbox status shows them with correct message counts. The errors show up on IMAP access but don't seem to break anything. We're using mdbox. On disk the directory is stored as mUTF-7: Antr&AOQ-ge doveadm mailbox list gives back the name with c3 a4 for the ä, which is already NFC. We double-checked with python3 unicodedata and it confirms the name is NFC. So it seems like dovecot is trying to rename something that doesn't need renaming, and then failing. Is there a way to turn off this automatic rename? Or is this a known issue with mdbox and mUTF-7 directory names? Any help would be appreciated to find out if this is a bug or a configuration issue on our side! Thanks, Jan

5 12

IMAP access problem with iOS Mail app
by Reg Barclay 29 Aug '26

29 Aug '26

Hi, We've been running Dovecot 2.3.x as IMAPS server for quite some years. It works with Thunderbird (our primary mail client), MS Outlook, K9 Mail (Android) and some iPhones / iOS Mail. But we cannot get new iPhones / new iOS to *initially* connect to the server. On the contrary, when the mail account was created in iOS years ago, it continues to work even with modern software versions on iOS. But we cannot set up the mail server on brandnew iPhones. It either loads/waits for minutes without anything happening. Or it gives some error message that an SSL connection could not be established. I've found several reports about similar problems on the web, particularly after iOS 18. Did someone of you have the same problem and managed to solve it? We have a trusted certificate from an "official" CA, so no self-signed certificate or something like that. We have many users working with the server successfully every day, even modern iPhones where the mail account was set up years ago on an older version. So it's not broken in general. The only problem is with new iPhones and the integrated iOS Mail app. Yours, Reg

2 1

Pigeonhole v2.4.5 tarball reuploaded
by Aki Tuomi 28 Aug '26

28 Aug '26

Hi! Due to logistics mistake, the pigeonhole tarball was reuploaded now to include man pages that had dropped out by mistake. No code changes or git changes sneaked in. Sorry for the inconvenience. Aki

1 0

Dovecot Security Advisory 3/2026
by Aki Tuomi 28 Aug '26

28 Aug '26

Hi! We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory will also be published at https://documentation.open-xchange.com/dovecot/security/advisories/html/202… --- Classification: TLP:GREEN Internal reference: DOV-8476 Type: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2025-11-25 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-33263 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor. When mail_max_userip_connections is set (defaul t 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. Risk: If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pr o releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplica te messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUT H stage. No publicly available exploits are known. Solution: Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. --- Internal reference: DOV-8874 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-11 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ylwango613@yeswehack CVE: CVE-2026-33607 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service. An attacker that has valid credentials can use IMAP LIST command to consume CPU. Risk: This can cause degradation or denial of service for IMAP. No publicly available exploits are known. Solution: Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. --- Internal reference: DOV-8884 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-13 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-27852 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: DoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME par ameters, which causes excessive memory usage when the message is later parsed. Risk: The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. No publicly available exploits are known. Solution: Update to non-vulnerable version. --- Internal reference: DOV-8941 Type: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-24 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: thanos_haruki@yeswehack CVE: CVE-2026-33606 CVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Details: dsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administ rator later runs dsync with the stream protocol, for example during a migration. Risk: Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. No publicly available exploits are known. Solution: Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. --- Internal reference: DOV-8947 Type: CWE-655 (Insufficient Psychological Acceptability) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-24 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: heckintosh@yeswehack CVE: CVE-2026-33604 CVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Details: SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. Risk: A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injec tion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available exploits are known. Solution: Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. --- Internal reference: DOV-8949 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-24 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: djvirus@yeswehack CVE: CVE-2026-40014 CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Details: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. Risk: When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. No publicly available exploits are known. Solution: Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. --- Internal reference: DOV-8991 Type: CWE-124 (Buffer Underwrite ('Buffer Underflow')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-02 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-40013 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. Risk: This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be used for re mote code execution. No publicly available exploits are known. Solution: Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version. --- Internal reference: DOV-8994 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-02 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-33605 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: managesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. Risk: If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. No publicly available exploits are known. Solution: Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. --- Internal reference: DOV-9039 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-08 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: tipsennn@yeswehack CVE: CVE-2026-40018 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: MySQL multi-byte escaping wrong. None Risk: None No publicly available exploits are known. Solution: None --- Internal reference: DOV-9041 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot CE core >=2.4.3 <2.4.5 First fixed revision: OX Dovecot CE core 2.4.5 Discovery date: 2026-04-08 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-40019 CVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: v2.4.3 regression: managesieve-login pre-auth infinite loop. An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which make s it spin in an infinite loop consuming CPU. Risk: This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. No publicly available e xploits are known. Solution: Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable vers ion. --- Internal reference: DOV-9046 Type: CWE-125 (Out-of-bounds Read) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-08 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: tipsennn@yeswehack CVE: CVE-2026-40015 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: imap-hibernate can be crashed. An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermi ttently cause an out-of-bounds read and crash the process. Risk: The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. No publicly available exploits are known. Solution: Disable IMAP hibernation. Update to non-vulnerable version. --- Internal reference: DOV-9047 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-08 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: djvirus@yeswehack CVE: CVE-2026-40017 CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Details: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c). An attacker that can send mail to a user can craft a message header whose va lues are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issu e from CVE-2026-40014 and is not addressed by that fix. Risk: Whenever a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. No publicly available exploits are known . Solution: Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. --- Internal reference: DOV-9066 Type: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-12 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilhamaf@yeswehack CVE: CVE-2026-40203 CVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Details: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text. When IMAP compression is enabled, the same compression state is reused across re sponses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. Risk: An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can confirm whether the body of a small message matches a guessed text . Recovery of arbitrary unknown content was not demonstrated, but the attack can disclose whether a secret-like message body matches a candidate. No publicly available ex ploits are known. Solution: Disable IMAP compression. Update to non-vulnerable version. --- Internal reference: DOV-9070 Type: CWE-416 (Use After Free) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-14 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-42007 CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H) Details: Sieve editheader RCE. An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, an d to write memory contents beyond the intended buffer into the delivered mail. Risk: This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in th e context of that process. No publicly available exploits are known. Solution: Disable the Sieve editheader extension. Update to non-vulnerable version. --- Internal reference: DOV-9099 Type: CWE-284 (Improper Access Control) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-22 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilhamaf@yeswehack CVE: CVE-2026-40204 CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Details: acl: lda_mailbox_autocreate can bypass acl restrictions. None Risk: None No publicly available exploits are known. Solution: None --- Internal reference: DOV-9106 Type: CWE-287 (Improper Authentication) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.11.2 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.11.2 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-23 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: Noobosaurus@yeswehack CVE: CVE-2026-40205 CVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N) Details: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path. An attacker that holds an OAuth2 token granting only part of the required scopes can au thenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the l ocal token validation path correctly requires all of them. Risk: The configured authorization policy is not enforced, so a token that was granted only part of the required permissions is accepted where it should have been rejected. No publicly available exploits are known. Solution: Use local token validation where tokens can be validated locally. Update to non-vulnerable version. --- Internal reference: DOV-9109 Type: CWE-287 (Improper Authentication) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.4 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.4 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-23 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-42008 CVSS: 4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Details: XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy. Forwarding information received from a host listed as a trusted proxy is not ke pt separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Risk: Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. No publicly available exploits are known. Solution: Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. --- Internal reference: DOV-9142 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-27 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilhamaf@yeswehack CVE: CVE-2026-42395 CVSS: 4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Details: Single NUL-Byte XCLIENT FORWARD Payload Crashes. A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process o n the following login attempt. Risk: The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. No publi cly available exploits are known. Solution: Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. --- Internal reference: DOV-9148 Type: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-27 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: D4RKCYPH3R@yeswehack CVE: CVE-2026-42393 CVSS: 3.1 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Details: doveadm_password or api key length can still be leaked with timing comparisons. The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. Risk: An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the sec ret, which reduces the effort needed to guess it. The secret value itself is not disclosed. No publicly available exploits are known. Solution: Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. --- Internal reference: DOV-9223 Type: CWE-1050 (Excessive Platform Resource Consumption within a Loop) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.15 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.15 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-05-05 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-52681 CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: Sieve resource usage tracking lost when active script changes. Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can r eset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. Risk: The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. Both can cause degradation of servic e for mail delivery. No publicly available exploits are known. Solution: Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version. --- Internal reference: DOV-9230 Type: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-05-06 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: djvirus@yeswehack CVE: CVE-2026-42392 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Details: imap-urlauth leaks memory into user-visible error messages. An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized m emory to be included in the error response returned to the client. Risk: Process memory contents can be disclosed to the client, which may include sensitive data. No publicly available exploits are known. Solution: Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. --- Internal reference: DOV-9309 Type: CWE-287 (Improper Authentication) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.13 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.13 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-05-28 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-73208 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: auth: db-oauth2: aud claim used as fallback for missing scope claim. An attacker that holds a token intended for a different purpose can authenticate, because when an OAu th2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concept s, and the audience claim does not describe what a token is allowed to do. Risk: A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should hav e been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. No publicly available exploits are known. Solution: Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. --- Internal reference: DOV-9401 Type: CWE-674 (Uncontrolled Recursion) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-06-10 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-73209 CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Details: imap-login crash: Self-recursion on zero-output decompress chunks. An attacker that has valid credentials can send crafted compressed data that causes the affected proces s to exhaust its stack and crash. Risk: The affected process is terminated, which can cause degradation or denial of service for IMAP. No publicly available exploits are known. Solution: Update to non-vulnerable version. --- Internal reference: DOV-9529 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-07-04 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-42391 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: imap: Pre-login memory/CPU growth with ID command. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. Risk: The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. No publicly available exploits are known. Solution: Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. --- Internal reference: DOV-9530 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.11 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.11 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-07-04 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-52687 CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Details: IMAP: COMPRESS ZSTD can cause excessive memory usage. An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompressio n state requires a large amount of memory, and open several such connections. Risk: The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of s ervice for IMAP. No publicly available exploits are known. Solution: Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulner able version.

1 0

Dovecot 2.4.2 auth unix socket rejects Postfix 3.10.6 handshake with EACCES
by root 27 Aug '26

27 Aug '26

Environment: Ubuntu 26.04 (resolute), kernel 7.0.0-30-generic, Postfix 3.10.6-4ubuntu2.1, Dovecot 2.4.2+dfsg1-3ubuntu2.1. Problem: Postfix smtpd (submission) connects to /var/spool/postfix/private/auth but write(VERSION...CPID...) returns EACCES. Log: "warning: SASL: Couldn't send handshake: Permission denied", then "fatal: no SASL authentication mechanisms". Socket permissions are correct (postfix:postfix 0660). Writing to the same socket as user postfix from python works. AppArmor in complain mode and removed profile - no change. Running postfix master manually (not via systemd) still fails. Only real smtpd process fails, python with same uid/gid succeeds. Workaround: inet listener on 127.0.0.1:3456 for auth works, AUTH succeeds.

3 2