Dovecot and Pigeonhole v2.4.5 released
Hi!
We are happy to publish version 2.4.5 of Dovecot and Pigeonhole. These contain CVEs, discovered by external researches. The majority of these have been discovered with help of automated code analysis tools like claude code security, which is why some of these are rather old, missed bugs.
Distributions have changed
- Jammy (Ubuntu 22.04) is no longer provided in repo.dovecot.org
- Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org
No new dependencies have been added.
Note that there are experimental features in 2.4, one is enabled with --enable-experimental-mail-utf8, and another with --enable-experimental-imap4rev2, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config.
https://dovecot.org/releases/2.4/dovecot-2.4.5.tar.gz https://dovecot.org/releases/2.4/dovecot-2.4.5.tar.gz.sig https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.5.tar.gz https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.5.tar.gz....
Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot
- CVE-2026-27852: Messages with a huge number of From/To/Cc/etc email addresses could result in excessive memory usage.
- CVE-2026-33263: Submission: Login service crashes with panic once mail_max_userip_connections limit is reached.
- CVE-2026-33604: The SMTP outbound dot-stuffing mechanism does not properly escape dots following a bare \r in message bodies, potentially allowing spoofed emails via malicious end-of-DATA injection.
- CVE-2026-33606: Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration.
- CVE-2026-33607: IMAP LIST command could be used to cause excessive CPU usage.
- CVE-2026-40014: IMAP THREAD command could have used excessive amount of CPU processing a single email with a massive number of Message-IDs in References header.
- CVE-2026-40015: Invalid IMAP command sent to imap-hibernate process might crash it.
- CVE-2026-40017: IMAP THREAD command could have used excessive amount of CPU processing emails with a large number of specially crafted Message-IDs in References header. The fix requires a new dovecot.index.thread file format, which is enabled only after setting dovecot_storage_version or newer. This rebuilds the index, so it will cause some extra CPU usage and extra metacache disk IO usage. It shouldn't cause (much) extra object storage IO, because all the fields should be coming from dovecot.index.cache.
- CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker could send mails into a victim's mailbox and observe network traffic to determine whether a secret message matched a known string by comparing compressed response sizes (a CRIME-style attack). The fix resets the compression dictionary after each IMAP command, preventing information from leaking between commands.
- CVE-2026-40205: If multiple OAUTH scopes were required, then this could have been only partially enforced with certain configurations.
- CVE-2026-4200: XCLIENT FORWARD allows to forward key only passdb fields without the "forward_" prefix which allows connections from trusted networks to set nopasswd field which allows to skip the authentication.
- CVE-2026-42391: Pre-login IMAP ID command could have used excessive amount of memory, causing the process to become killed and disconnecting all the other IMAP connections being proxied by the process. Or alternatively it could have caused excessive CPU usage, slowing down all the other IMAP connections being proxied by the process.
- CVE-2026-42392: If URLAUTH is enabled, sending an invalid IMAP URLFETCH can result in an untagged NO response containing uninitialized memory, potentially leaking sensitive data.
- CVE-2026-42393: Doveadm password length or API key length could still be determined via timing based attacks.
- CVE-2026-42395: XCLIENT FORWARD command from login_trusted_networks could have been used to cause login processes to crash.
- CVE-2026-52681: Sieve resource usage (sieve_max_cpu_time) was tracked in the active Sieve binary. Switching to a different active binary could have been used to reset (bypass) the resource usage.
- CVE-2026-52687: Using IMAP COMPRESS ZSTD command can cause excessive memory usage in imap-login process, possibly making it reach vsz_limit and kill all the connections being served by the process. Fixed by disabling COMPRESS command with all other compression algorithms than the standard DEFLATE.
- CVE-2026-73208: In oauth2, scope/aud checking was done with JWT tokens. Now it requires all scopes.
- CVE-2026-73209: Sending IMAP COMPRESS package containing zero-length frames crashes imap or imap-login process.
- auth: SIGHUP no longer flushes the passdb cache and SIGUSR2 no longer logs cache statistics. Use "doveadm auth cache flush" and the new "doveadm auth cache status" instead.
- auth: The OTP authentication mechanism, the {OTP} password scheme and the passdb set-credentials support have been removed. They were unmaintained and unused. This also drops the passdb_sql_update_query setting.
- config: doveconf no longer prints a flat global setting when a top-level named filter overrides the same setting.
- doveadm: The doveadm protocol has been bumped to v1.4. The server uses the newer multiplex stream format with clients supporting it. Older clients keep working unchanged.
- imap: Change imap_compress_on_proxy default to yes.
- lib-dict-extra: Increase dict client request timeout from 30s to 65s, so it stays above the SQL/Cassandra query timeout.
- lib-http: HTTP requests are now parsed strictly: obsolete line folding (obs-fold) and a bare LF line terminator are rejected. Both are request desynchronization/smuggling risks. HTTP responses are still parsed leniently.
- lib-storage: A '~' in a mailbox name is now escaped only when it is at the beginning of the mailbox name, not at the beginning of every hierarchy part. Directories written by older versions are migrated automatically while listing mailboxes.
- lib-var-expand: Add %{time:unix} provider and the epoch, from_epoch, date, iso8601 and escape filters. Deprecates the old time providers.
- lib-var-expand: The safe filter must now be the last filter in the chain.
- master: Increase the timeout after config reload before killing still running old processes from 6s to 35s, so that lib-master can stop them gracefully first.
- config: Support heredoc syntax for multi-line setting values: key = <<EOD ... EOD. doveconf now outputs inline SET_FILE contents (e.g. ssl_ca) using heredoc instead of the "inline:" prefix. The "inline:" form is still accepted.
- configure: Build imap-hibernate also when only kqueue notify is available.
- doveadm: Add "doveadm auth cache status" command, with --reset for clearing the counters.
- doveadm: dump - List all supported dump types, and print the key type also for KEM and unsupported keys.
- fts-flatcurve: Add support for phrase searching. This fixes false positives where the searched words existed, but not as a phrase.
- fts-flatcurve: Delete the FTS index directory also when a Maildir mailbox is deleted.
- imap: Add [THROTTLED] response code to tagged replies when a plugin has throttled the command.
- last-login: Add last_login_dict_fields setting for updating multiple dictionary fields at login.
- lib-dcrypt: Add ML-KEM-512/768/1024 support with OpenSSL 3.
- lib-dcrypt: Support AEAD with Dovecot key encryption.
- lib-settings: Expand %{variables} also in strlist and boollist keys.
- lib-sql: sqlite - Add sqlite_busy_timeout setting, default 1s.
- login-common: Log the destination also when a proxy connection fails.
- quota: Update quota-clone also when "doveadm quota recalc" is run.
- Fix building on systems with a signed 32-bit time_t.
- Fix building with Lua when LUA_LIBS contains linker flags such as -L.
- anvil: Fix busy loop eating CPU after an admin socket connection was disconnected.
- auth: Fix authentication failing after a password change when the passdb cache entry was verified by an auth worker.
- auth: Fix the credentials scheme of one passdb leaking into the next one during a multi-passdb lookup.
- auth: oauth2 - Fix losing userdb_* fields during OAUTHBEARER authentication.
- auth: passwd-file - Fix %{passdb:...} and %{userdb:...} expansion returning garbage or crashing.
- config: Fix crash in "doveconf -f" for a filter that includes a @group.
- config: Fix crash when including a default @group into a filter.
- config: Fix hiding secrets in doveconf output.
- config: Fix startup failures with some settings containing %{variables}.
- configure: Fix BUILD_IMAP_HIBERNATE detection.
- doc: solr-schema-9.xml - Add the mandatory tokenizer class attribute.
- doveadm: compress-connect - Fix writing server input to a non-blocking stdout.
- doveadm: fs delete - Fix crash with concurrent async deletes.
- doveconf: Fix bogus "Multiple settings matched" error when stdout is redirected to a file that already has content.
- dsync: Fix truncating a mailbox attribute value when it is compared to the local one, e.g. truncating a Sieve script.
- dsync: backup - Mailbox attributes changed or created only in the destination are now reverted or deleted.
- fts-flatcurve: Ignore index directory entries that vanish during iteration.
- fts: Don't run FTS optimize on forced resync.
- fts: build-mail - Fix accessing Content-Type header buffer out of bounds.
- imap-login, pop3-login: Tolerate SASL continuations "+" without a trailing space when proxying authentication.
- imap: Don't report FETCH output stream errors as "BUG: Unknown internal error".
- imap: Fix hibernation always failing on FreeBSD.
- imap: Fix panic on GETMETADATA with an invalid UTF-8 mailbox pattern.
- imapc: Don't send SEEEN/UNSEEN to the remote server when private indexes are used.
- imapc: Fix SEARCH results pointing at wrong messages after an untagged EXPUNGE.
- imapc: Fix SORT returning an empty result when search criteria were used.
- imapc: Fix crash when copying a mail that was already expunged in the source mailbox.
- imapc: Fix stale SEARCH/SORT results after a STORE in the same session.
- imapc: Honor imapc_features=no-search also for SORT.
- imapc: Properly handle search criteria that can be sent to remote server.
- lib-dcrypt: Don't panic on key algorithms the backend doesn't support.
- lib-dcrypt: Fix x9.62 ECDSA signatures randomly failing verification.
- lib-dict-backend: cdb - Fix use-after-free of the returned key.
- lib-dns-client: Fix handling of a disconnect initiated by the dns-client service.
- lib-fs: Fix panic in fs_write_stream_abort(), e.g. when the disk is full during FTS indexing.
- lib-index: Fix "File is already open" error when appending to the transaction log while another process is rotating it. This showed up as "NO [SERVERBUG] Internal error occurred." without any logging.
- lib-ldap: Fall back to system default CA paths, needed for OpenLDAP built against GnuTLS.
- lib-mail: istream-binary-converter - Fix heap use-after-free with a bodyless MIME part.
- lib-mail: message-parser - Fix out of bounds read with an empty preamble, fix skipping the epilogue boundary line, and degrade to a re-parse instead of panicking with an inconsistent cached MIME tree.
- lib-master: Fix kick reason when the KICK-USER-SIGNAL command arrives late, which logged "Killed with signal 15" instead of "User kicked".
- lib-oauth2: jwt - Fix use-after-realloc, guard against an empty body segment and percent-encode bare "." and ".." identifiers.
- lib-program-client: Fix panic upon irregular termination.
- lib-settings: Fix sorting of the settings history, which caused changed defaults and renames to be ignored once a plugin registered its own history, if dovecot_config_version has been set to greater than 2.4.0.
- lib-smtp: Fix assert with an empty broken localpart.
- lib-smtp: xclient - Reject an invalid HELO parameter with 501.
- lib-sql: pgsql - Fix binary field values for rows after the first. This mainly affected dict-sql maps with hexblob fields.
- lib-ssl-iostream: Fix crash at process exit with OpenSSL 4.0.
- lib-storage: Don't log an error when the client resets the connection while saving a mail.
- lib-storage: Fix crash when reverting a failed mailbox deletion.
- lib-storage: Fix decoded size calculation for base64 attachments, which could delete the cache record of a mail with a detached attachment.
- lib-storage: Fix handling escaped mailbox names in the mailbox list index.
- lib-storage: Fix rewriting non-NFC subscriptions with mUTF-7 storage names, which caused repeated rename errors.
- lib-storage: Fix searching flags when the view is not up to date. This broke e.g. a pipelined UID STORE +FLAGS \Deleted followed by UID EXPUNGE.
- lib-storage: Fix the mailbox vsize header not being repaired when it is corrupted, causing wrong mailbox sizes to be reported.
- lib-storage: thread - Fix panic when running IMAP THREAD in multiple connections in parallel.
- lib-var-expand: Reject an empty separator in the index filter, which caused an infinite loop.
- lib: Fix crash and out of bounds reads when decoding IDN addresses. Reachable only with the experimental mail UTF-8 support enabled.
- lib: ioloop - Fix panic and delayed timeouts when time moves forwards.
- lib: ostream-multiplex - Fix stalls, busy loops and a panic when streaming data through a multiplexed connection, e.g. IMAP FETCH through a login proxy or TLS connections.
- login-common: Fix connection hanging if an ostream write failed. This happened at least with HAProxy health check connections.
- login-common: Fix real_remote_ip being looked up incorrectly.
- login-common: Reject proxy credentials with ASCII control characters.
- login-proxy: Fix "doveadm kick" for proxied connections in high-security mode, and log "Kicked by admin" as the reason.
- maildir: Fix random SEARCH failures when another session concurrently expunges mails.
- quota: Fix maildir quota dropping to zero after IMAP MOVE or REPLACE.
- submission-login: proxy - Fix crash and unbounded memory usage with a multi-line or malformed AUTH reply from the backend.
- CVE-2026-33605: managesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.
- CVE-2026-40019: v2.4.3 regression: managesieve-login pre-auth infinite loop. An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU.
- CVE-2026-42007: sieve-editheader: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer in the delivered mail.
- lib-sieve: sieve_max_cpu_time now defaults to 30s globally, so the limit also applies to MDA delivery. Previously the global default was unlimited and only imap_sieve used 30s. The old defaults are kept for older dovecot_config_version values.
- lib-sieve: enotify - The number of notify actions performed during a single script execution is now limited to 10 by default. See the new sieve_notify_max_notifications setting.
- lib-sieve: enotify - A single "mailto:" notify action is now limited to 8 recipients and 16 additional headers by default. See the new sieve_notify_mailto_max_recipients and sieve_notify_mailto_max_headers settings.
- imap-filter-sieve: FILTER SIEVE SCRIPT literals larger than sieve_max_script_size are now rejected before the script is read.
- lib-sieve: Fix stack overflow occurring when a script requires the same extension repeatedly.
- lib-sieve: encoded-character - Fix integer overflow parsing ${unicode:...} values with 9 or more hex digits.
- lib-sieve: variables - Fix integer overflow parsing numeric variable index.
- lib-sieve: regex - Fix panic occurring when more than 8 group values are matched.
- lib-sieve: ldap - Fix LDAP settings missing from the LDAP storage plugin.
- managesieve-login: Fix capability reporting when Sieve settings use %variables.
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
- Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org
I'm following the instructions to add the Debian repo for Ubuntu 26.04.
On apt update I get this error:
W: No Hash entry in Release file /var/lib/apt/lists/partial/repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease which is considered strong enough for security purposes E: The repository 'https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute resolute InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing SHA256 and SHA5132 checksums. Apparently they are required on 26.04 now according to the error message.
Could you please add them to make installation possible?
Best regards,
Patrick Cernko <pcernko@mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme
Since CVE includes CE 2.3.21.1 will you release new CE version, i see you did pro 2.3 but not CE
On Sat, Aug 29, 2026 at 8:38 AM Patrick Cernko via dovecot < dovecot@dovecot.org> wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
- Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org
I'm following the instructions to add the Debian repo for Ubuntu 26.04. On
apt updateI get this error:W: No Hash entry in Release file /var/lib/apt/lists/partial/repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease
which is considered strong enough for security purposes
E: The repository 'https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute resolute InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing SHA256 and SHA5132 checksums. Apparently they are required on 26.04 now according to the error message.
Could you please add them to make installation possible?
Best regards,
Patrick Cernko <pcernko@mpi-klsb.mpg.de> +49 681 9325 5815 <+49%20681%2093255815> Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme
dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org
Since CVE includes CE 2.3.21.1 will you release new CE version, i see you did pro 2.3 but not CE On Sat, Aug 29, 2026 at 8:38AM Patrick Cernko via dovecot <[1]dovecot@dovecot.org> wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
>
> - Resolute Raccoon (Ubuntu 26.04) has been added to
[2]repo.dovecot.org
>
I'm following the instructions to add the Debian repo for Ubuntu 26.04.
On `apt update` I get this error:
> W: No Hash entry in Release file
/var/lib/apt/lists/partial/repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease
which is considered strong enough for security purposes
> E: The repository
'[3]https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute resolute
InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing
SHA256 and SHA5132 checksums. Apparently they are required on 26.04 now
according to the error message.
Could you please add them to make installation possible?
Best regards,
--
Patrick Cernko <[4]pcernko@mpi-klsb.mpg.de> [5]+49 681 9325 5815
Joint Scientific IT and Technical Service
Max-Planck-Institute fuer Informatik & Softwaresysteme
_______________________________________________
dovecot mailing list -- [6]dovecot@dovecot.org
To unsubscribe send an email to [7]dovecot-leave@dovecot.orgReferences
Visible links
- mailto:dovecot@dovecot.org
- http://repo.dovecot.org/
- https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
- mailto:pcernko@mpi-klsb.mpg.de
- file:///tmp/tmp_ex4krg9/tel:+49%20681%2093255815
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
Hi!
We are not planning to do a 2.3 CE release.
Aki
On 29/08/2026 09:49 EEST Laura Steynes via dovecot
<[1]dovecot@dovecot.org> wrote:
Since CVE includes CE 2.3.21.1 will you release new CE version, i see
you
did pro 2.3 but not CE
On Sat, Aug 29, 2026 at 8:38AM Patrick Cernko via dovecot <
[2]dovecot@dovecot.org> wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
>
> - Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org
>
I'm following the instructions to add the Debian repo for Ubuntu
26.04.
On `apt update` I get this error:
> W: No Hash entry in Release file
/var/lib/apt/lists/partial/repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease
which is considered strong enough for security purposes
> E: The repository
'[3]https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute resolute
InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing
SHA256 and SHA5132 checksums. Apparently they are required on 26.04
now
according to the error message.
Could you please add them to make installation possible?
Best regards,
--
Patrick Cernko <[4]pcernko@mpi-klsb.mpg.de> +49 681 9325 5815
<+49%20681%2093255815>
Joint Scientific IT and Technical Service
Max-Planck-Institute fuer Informatik & Softwaresysteme
_______________________________________________
dovecot mailing list -- [5]dovecot@dovecot.org
To unsubscribe send an email to [6]dovecot-leave@dovecot.org
Since CVE includes CE 2.3.21.1 will you release new CE version, i see
you
did pro 2.3 but not CE
On Sat, Aug 29, 2026 at 8:38AM Patrick Cernko via dovecot
<[1][7]dovecot@dovecot.org> wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
>
> - Resolute Raccoon (Ubuntu 26.04) has been added to
[2]repo.dovecot.org
>
I'm following the instructions to add the Debian repo for Ubuntu 26.04.
On `apt update` I get this error:
> W: No Hash entry in Release file
/var/lib/apt/lists/partial/repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease
which is considered strong enough for security purposes
> E: The repository
'[3][8]https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute resolute
InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing
SHA256 and SHA5132 checksums. Apparently they are required on 26.04 now
according to the error message.
Could you please add them to make installation possible?
Best regards,
--
Patrick Cernko <[4][9]pcernko@mpi-klsb.mpg.de> [5]+49 681 9325 5815
Joint Scientific IT and Technical Service
Max-Planck-Institute fuer Informatik & Softwaresysteme
_______________________________________________
dovecot mailing list -- [6][10]dovecot@dovecot.org
To unsubscribe send an email to [7][11]dovecot-leave@dovecot.org
References
Visible links
1. mailto:[12]dovecot@dovecot.org
2. [13]http://repo.dovecot.org/
3. [14]https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
4. mailto:[15]pcernko@mpi-klsb.mpg.de
5. file:///tmp/tmp_ex4krg9/tel:+49%20681%2093255815
6. mailto:[16]dovecot@dovecot.org
7. mailto:[17]dovecot-leave@dovecot.org
_______________________________________________
dovecot mailing list -- [18]dovecot@dovecot.org
To unsubscribe send an email to [19]dovecot-leave@dovecot.orgReferences
Visible links
- mailto:dovecot@dovecot.org
- mailto:dovecot@dovecot.org
- https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
- mailto:pcernko@mpi-klsb.mpg.de
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
- mailto:dovecot@dovecot.org
- https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
- mailto:pcernko@mpi-klsb.mpg.de
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
- mailto:dovecot@dovecot.org
- http://repo.dovecot.org/
- https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
- mailto:pcernko@mpi-klsb.mpg.de
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
So this is the second release with CVE's you are doing nothing about in the CE 2.3 why have you not announced it is EOL, since you no longer seem to care about your users stuck on it, you should EOL it so we know to consider our options, this is really poor treatment,fair enough if you don't want look after those users, but tell them!
On Sat, Aug 29, 2026 at 6:17 PM Aki Tuomi <aki.tuomi@open-xchange.com> wrote:
Hi!
We are not planning to do a 2.3 CE release.
Aki
On 29/08/2026 09:49 EEST Laura Steynes via dovecot <dovecot@dovecot.org> wrote:
Since CVE includes CE 2.3.21.1 will you release new CE version, i see you did pro 2.3 but not CE
On Sat, Aug 29, 2026 at 8:38 AM Patrick Cernko via dovecot < dovecot@dovecot.org> wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
- Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org
I'm following the instructions to add the Debian repo for Ubuntu 26.04. On
apt updateI get this error:W: No Hash entry in Release file
/var/lib/apt/lists/partial/repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease
which is considered strong enough for security purposes
E: The repository 'https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute resolute InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing SHA256 and SHA5132 checksums. Apparently they are required on 26.04 now according to the error message.
Could you please add them to make installation possible?
Best regards,
Patrick Cernko <pcernko@mpi-klsb.mpg.de> +49 681 9325 5815 <+49%20681%2093255815> <+49%20681%2093255815> Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme
dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org
Since CVE includes CE 2.3.21.1 will you release new CE version, i see you did pro 2.3 but not CE On Sat, Aug 29, 2026 at 8:38AM Patrick Cernko via dovecot <[1]dovecot@dovecot.org> wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
- Resolute Raccoon (Ubuntu 26.04) has been added to
[2]repo.dovecot.org
I'm following the instructions to add the Debian repo for Ubuntu 26.04. On
apt updateI get this error:W: No Hash entry in Release file
/var/lib/apt/lists/partial/repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease which is considered strong enough for security purposes
E: The repository '[3]https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute resolute InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing SHA256 and SHA5132 checksums. Apparently they are required on 26.04 now according to the error message.
Could you please add them to make installation possible?
Best regards,
Patrick Cernko <[4]pcernko@mpi-klsb.mpg.de> [5]+49 681 9325 5815 <+49%20681%2093255815> Joint Scientific IT and Technical Service Max-Planck-Institute fuer Informatik & Softwaresysteme
dovecot mailing list -- [6]dovecot@dovecot.org To unsubscribe send an email to [7]dovecot-leave@dovecot.org
References
Visible links
- mailto:dovecot@dovecot.org
- http://repo.dovecot.org/
- https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
- mailto:pcernko@mpi-klsb.mpg.de
- file:///tmp/tmp_ex4krg9/tel:+49%20681%2093255815
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org
So this is the second release with CVE's you are doing nothing about in the CE 2.3 why have you not announced it is EOL, since you no longer seem to care about your users stuck on it, you should EOL it so we know to consider our options, this is really poor treatment,fair enough if you don't want look after those users, but tell them! On Sat, Aug 29, 2026 at 6:17PM Aki Tuomi <[1]aki.tuomi@open-xchange.com> wrote:
Hi!
We are not planning to do a 2.3 CE release.
Aki
On 29/08/2026 09:49 EEST Laura Steynes via dovecot
<[2]dovecot@dovecot.org> wrote:
Since CVE includes CE 2.3.21.1 will you release new CE version, i see
you
did pro 2.3 but not CE
On Sat, Aug 29, 2026 at 8:38AM Patrick Cernko via dovecot <
[3]dovecot@dovecot.org> wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
>
> - Resolute Raccoon (Ubuntu 26.04) has been added to
[4]repo.dovecot.org
>
I'm following the instructions to add the Debian repo for Ubuntu
26.04.
On `apt update` I get this error:
> W: No Hash entry in Release file
/var/lib/apt/lists/partial/repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease
which is considered strong enough for security purposes
> E: The repository
'[5]https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute resolute
InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are
missing
SHA256 and SHA5132 checksums. Apparently they are required on 26.04
now
according to the error message.
Could you please add them to make installation possible?
Best regards,
--
Patrick Cernko <[6]pcernko@mpi-klsb.mpg.de> [7]+49 681 9325 5815
<+49%20681%2093255815>
Joint Scientific IT and Technical Service
Max-Planck-Institute fuer Informatik & Softwaresysteme
_______________________________________________
dovecot mailing list -- [8]dovecot@dovecot.org
To unsubscribe send an email to [9]dovecot-leave@dovecot.org
Since CVE includes CE 2.3.21.1 will you release new CE version, i see
you
did pro 2.3 but not CE
On Sat, Aug 29, 2026 at 8:38AM Patrick Cernko via dovecot
<[1][10]dovecot@dovecot.org> wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
>
> - Resolute Raccoon (Ubuntu 26.04) has been added to
[2][11]repo.dovecot.org
>
I'm following the instructions to add the Debian repo for Ubuntu
26.04.
On `apt update` I get this error:
> W: No Hash entry in Release file
/var/lib/apt/lists/partial/repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease
which is considered strong enough for security purposes
> E: The repository
'[3][12]https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
resolute
InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing
SHA256 and SHA5132 checksums. Apparently they are required on 26.04
now
according to the error message.
Could you please add them to make installation possible?
Best regards,
--
Patrick Cernko <[4][13]pcernko@mpi-klsb.mpg.de> [5][14]+49 681 9325
5815
Joint Scientific IT and Technical Service
Max-Planck-Institute fuer Informatik & Softwaresysteme
_______________________________________________
dovecot mailing list -- [6][15]dovecot@dovecot.org
To unsubscribe send an email to [7][16]dovecot-leave@dovecot.org
References
Visible links
1. mailto:[17]dovecot@dovecot.org
2. [18]http://repo.dovecot.org/
3. [19]https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
4. mailto:[20]pcernko@mpi-klsb.mpg.de
5. file:///tmp/tmp_ex4krg9/tel:+49%20681%2093255815
6. mailto:[21]dovecot@dovecot.org
7. mailto:[22]dovecot-leave@dovecot.org
_______________________________________________
dovecot mailing list -- [23]dovecot@dovecot.org
To unsubscribe send an email to [24]dovecot-leave@dovecot.orgReferences
Visible links
- mailto:aki.tuomi@open-xchange.com
- mailto:dovecot@dovecot.org
- mailto:dovecot@dovecot.org
- http://repo.dovecot.org/
- https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
- mailto:pcernko@mpi-klsb.mpg.de
- file:///tmp/tmpn25i50gt/tel:+49%20681%2093255815
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
- mailto:dovecot@dovecot.org
- http://repo.dovecot.org/
- https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
- mailto:pcernko@mpi-klsb.mpg.de
- file:///tmp/tmpn25i50gt/tel:+49%20681%2093255815
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
- mailto:dovecot@dovecot.org
- http://repo.dovecot.org/
- https://repo.dovecot.org/ce-2.4-latest/ubuntu/resolute
- mailto:pcernko@mpi-klsb.mpg.de
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
- mailto:dovecot@dovecot.org
- mailto:dovecot-leave@dovecot.org
On 2026-08-31 11:34:41, Laura Steynes via dovecot wrote:
So this is the second release with CVE's you are doing nothing about in the CE 2.3 why have you not announced it is EOL, since you no longer seem to care about your users stuck on it, you should EOL it so we know to consider our options, this is really poor treatment,fair enough if you don't want look after those users, but tell them!
I think he just did. If memory serves, dovecot has never supported older release branches. If you're stuck on 2.3 because your distro is stuck on 2.3, it's their responsibility to backport the patches. And aside from that there are not too many ways you could actually be stuck.
On Mon, Aug 31, 2026 at 5:56 AM Laura Steynes via dovecot < dovecot@dovecot.org> wrote:
So this is the second release with CVE's you are doing nothing about in the CE 2.3 why have you not announced it is EOL, since you no longer seem to care about your users stuck on it, you should EOL it so we know to consider our options, this is really poor treatment,fair enough if you don't want look after those users, but tell them!
There was a clear statement that CE 2.3 support was being dropped. That is the same thing as declaring an EoL, no? I remember passing that information to some friends, especially because they were on FreeBSD, which still did not have a port for v2.4. I believe it was also for that same reason that the Dovecot developers did a conversion tool to help with migration from 2.3. But there were a few people who decided that they'd not migrate because of some v2.3 feature that was dropped in 2.4, IIRC.
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
On Mon, Aug 31, 2026 at 5:56AM Laura Steynes via dovecot <[1]dovecot@dovecot.org> wrote:
So this is the second release with CVE's you are doing nothing about
in
the CE 2.3 why have you not announced it is EOL, since you no longer
seem
to care about your users stuck on it, you should EOL it so we know
to
consider our options, this is really poor treatment,fair enough if
you
don't want look after those users, but tell them!There was a clear statement that CE 2.3 support was being dropped. That is the same thing as declaring an EoL, no? I remember passing that information to some friends, especially because they were on FreeBSD, which still did not have a port for v2.4. I believe it was also for that same reason that the Dovecot developers did a conversion tool to help with migration from 2.3. But there were a few people who decided that they'd not migrate because of some v2.3 feature that was dropped in 2.4, IIRC.
Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' -\_(Tu)_/- :-) [How to ask smart questions: [2]http://www.catb.org/~esr/faqs/smart-questions.html]
References
Visible links
- mailto:dovecot@dovecot.org
- http://www.catb.org/~esr/faqs/smart-questions.html
Where? the download page still lists 2.3, makes no mention its EOL and I've scanned the announce folder and don't see anything about 2.3 EOL'd I know several big players still using 2.3 because of the drastic config changes where dovecot think every system admin is a bloody developer.
On Mon, Aug 31, 2026 at 5:30 PM Washington Odhiambo <odhiambo@gmail.com> wrote:
On Mon, Aug 31, 2026 at 5:56 AM Laura Steynes via dovecot < dovecot@dovecot.org> wrote:
So this is the second release with CVE's you are doing nothing about in the CE 2.3 why have you not announced it is EOL, since you no longer seem to care about your users stuck on it, you should EOL it so we know to consider our options, this is really poor treatment,fair enough if you don't want look after those users, but tell them!
There was a clear statement that CE 2.3 support was being dropped. That is the same thing as declaring an EoL, no? I remember passing that information to some friends, especially because they were on FreeBSD, which still did not have a port for v2.4. I believe it was also for that same reason that the Dovecot developers did a conversion tool to help with migration from 2.3. But there were a few people who decided that they'd not migrate because of some v2.3 feature that was dropped in 2.4, IIRC.
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
Where? the download page still lists 2.3, makes no mention its EOL and I've scanned the announce folder and don't see anything about 2.3 EOL'd I know several big players still using 2.3 because of the drastic config changes where dovecot think every system admin is a bloody developer. On Mon, Aug 31, 2026 at 5:30PM Washington Odhiambo <[1]odhiambo@gmail.com> wrote:
On Mon, Aug 31, 2026 at 5:56AM Laura Steynes via dovecot
<[2]dovecot@dovecot.org> wrote:
So this is the second release with CVE's you are doing nothing
about in
the CE 2.3 why have you not announced it is EOL, since you no
longer seem
to care about your users stuck on it, you should EOL it so we know
to
consider our options, this is really poor treatment,fair enough if
you
don't want look after those users, but tell them!
There was a clear statement that CE 2.3 support was being dropped. That
is the same thing as declaring an EoL, no?
I remember passing that information to some friends, especially because
they were on FreeBSD, which still did not have a port for v2.4.
I believe it was also for that same reason that the Dovecot developers
did a conversion tool to help with migration from 2.3.
But there were a few people who decided that they'd not migrate because
of some v2.3 feature that was dropped in 2.4, IIRC.
--
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
In an Internet failure case, the #1 suspect is a constant: DNS.
"Oh, the cruft.", egrep -v '^$|^.*#' -\_(Tu)_/- :-)
[How to ask smart
questions: [3]http://www.catb.org/~esr/faqs/smart-questions.html]References
Visible links
- mailto:odhiambo@gmail.com
- mailto:dovecot@dovecot.org
- http://www.catb.org/~esr/faqs/smart-questions.html
On Monday, August 31, 2026 1:34:41 AM Coordinated Universal Time Laura Steynes via dovecot wrote:
So this is the second release with CVE's you are doing nothing about in the CE 2.3 why have you not announced it is EOL, since you no longer seem to care about your users stuck on it, you should EOL it so we know to consider our options, this is really poor treatment,fair enough if you don't want look after those users, but tell them!
There is a good tutorial HERE[1] that uses Dovecot 2.4 for its implementation. You may be able to use just parts of it or the full tutorial.
[1] https://pieterbakker.com/build-mail-server-debian-13-complete-series/
On Monday, August 31, 2026 1:34:41 AM Coordinated Universal Time Laura Steynes via dovecot wrote:
So this is the second release with CVE's you are doing nothing about in the
CE 2.3 why have you not announced it is EOL, since you no longer seem to
care about your users stuck on it, you should EOL it so we know to
consider our options, this is really poor treatment,fair enough if you
don't want look after those users, but tell them!
There is a good tutorial [1]HERE that uses Dovecot 2.4 for its implementation. You may be able to use just parts of it or the full tutorial.
References
Visible links
Hi Aki, hi Devs,
On 2026-08-28 18:25:21, Patrick Cernko via dovecot wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
- Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org
I'm following the instructions to add the Debian repo for Ubuntu 26.04. On
apt updateI get this error:W: No Hash entry in Release file /var/lib/apt/lists/partial/ repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease which is considered strong enough for security purposes E: The repository 'https://repo.dovecot.org/ce-2.4-latest/ubuntu/ resolute resolute InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing SHA256 and SHA5132 checksums. Apparently they are required on 26.04 now according to the error message.
Could you please add them to make installation possible?
I have the impression, my issue got lost or buried.
The issue still persists. As a workaround, I'm currently using these apt switches:
-o Acquire::AllowWeakRepositories=true --allow-unauthenticated
Could you please fix the Release files for Ubuntu 26.04 to work without this by adding SHA256 and SHA5132 checksums?
Best regards,
Patrick Cernko <pcernko@mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Software Systems
On 18/09/2026 08:41 EEST Patrick Cernko via dovecot <dovecot@dovecot.org> wrote:
Hi Aki, hi Devs,
On 2026-08-28 18:25:21, Patrick Cernko via dovecot wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
- Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org
I'm following the instructions to add the Debian repo for Ubuntu 26.04. On
apt updateI get this error:W: No Hash entry in Release file /var/lib/apt/lists/partial/ repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease which is considered strong enough for security purposes E: The repository 'https://repo.dovecot.org/ce-2.4-latest/ubuntu/ resolute resolute InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing SHA256 and SHA5132 checksums. Apparently they are required on 26.04 now according to the error message.
Could you please add them to make installation possible?
I have the impression, my issue got lost or buried.
The issue still persists. As a workaround, I'm currently using these apt switches:
-o Acquire::AllowWeakRepositories=true --allow-unauthenticated
Could you please fix the Release files for Ubuntu 26.04 to work without this by adding SHA256 and SHA5132 checksums?
Best regards,
Patrick Cernko <pcernko@mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Software Systems
Hi!
Buried indeed, can you try now?
Aki
Hi Aki,
On 2026-09-18 09:54:06, Aki Tuomi via dovecot wrote:
On 18/09/2026 08:41 EEST Patrick Cernko via dovecot <dovecot@dovecot.org> wrote:
Hi Aki, hi Devs,
On 2026-08-28 18:25:21, Patrick Cernko via dovecot wrote:
Hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via Dovecot-news wrote:
- Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org
I'm following the instructions to add the Debian repo for Ubuntu 26.04. On
apt updateI get this error:W: No Hash entry in Release file /var/lib/apt/lists/partial/ repo.dovecot.org_ce-2.4-latest_ubuntu_resolute_dists_resolute_InRelease which is considered strong enough for security purposes E: The repository 'https://repo.dovecot.org/ce-2.4-latest/ubuntu/ resolute resolute InRelease' provides only weak security information.
As far as I can tell, the InRelease and the Release files are missing SHA256 and SHA5132 checksums. Apparently they are required on 26.04 now according to the error message.
Could you please add them to make installation possible?
I have the impression, my issue got lost or buried.
The issue still persists. As a workaround, I'm currently using these apt switches:
-o Acquire::AllowWeakRepositories=true --allow-unauthenticated
Could you please fix the Release files for Ubuntu 26.04 to work without this by adding SHA256 and SHA5132 checksums?
Best regards,
Patrick Cernko <pcernko@mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Software Systems
Hi!
Buried indeed, can you try now?
Works! Thank you!
Patrick Cernko <pcernko@mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme
Hi all, hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via dovecot wrote:
- CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker could send mails into a victim's mailbox and observe network traffic to determine whether a secret message matched a known string by comparing compressed response sizes (a CRIME-style attack). The fix resets the compression dictionary after each IMAP command, preventing information from leaking between commands. Commit: https://github.com/dovecot/core/commit/bc04ca866cbdd9a3228816fbc302c2024d207...
...
- imap: Change imap_compress_on_proxy default to yes. These two changes together break backward compatibility for 2.4.5 backends with before-2.4.4 proxy frontends. The old frontends cannot handle "dict_reset" (imap_proxy_side_channel_input()) yet but the backend repeatedly sends them. The log on the proxy repeatedly complains:
imap-login: Error: proxy(REDACTED): Side channel input: dict_reset: Unsupported command: user=<REDACTED>, method=PLAIN, rip=REDACTED, lip=REDACTED, TLS, session=<HkufcGla0PWPXeFu>
and the client (Thunderbird) did not display any new mail but also *no errors*. TB just silently cut the user off from any updates in the IMAP mailbox. I did not test how other clients would have reacted. I assume any client not enabling compression would be not affected at all.
As a workaround I disabled imap_compress_on_proxy again on the backend, now explicitly due to the changed default. I'm not sure if this also reverts/masks the fix for CVE-2026-40203 but at least, it fixes the DoS the changes caused in our setup. Aki, Timo, do you think *DISABLING* IMAP compress support completely is a more secure workaround with respect to CVE-2026-40203?
I will try to enable imap_compress_on_proxy again once all proxy frontends have been updated to 2.4.5.
I hope this mail helps others to avoid a long debugging session. ;-)
Patrick Cernko <pcernko@mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme
participants (6)
-
Aki Tuomi
-
Jason Marinaro
-
Laura Steynes
-
Michael Orlitzky
-
Patrick Cernko
-
Washington Odhiambo