Auth panic after SIGHUP: sasl_server_instance_unref() assertion failed on Dovecot 2.4.5
Hello Dovecot Team, I would like to report an authentication-process crash in Dovecot 2.4.5. Environment
- Dovecot version: 2.4.5
- Package: 2:2.4.5+dfsg1-2onehop1 (please confirm against the installed package) - our internal custom build
- Operating system: Ubuntu 24.04 LTS (Noble)
- Service: Dovecot submission authentication
- Authentication backend: custom Lua authentication and target lookup over HTTP
- Core dump: unavailable for this incident
Observed error On October 15, 2026, the following sequence appeared in the logs. First, Dovecot reloaded its configuration:
Oct 15 00:29:12 Warning: master: SIGHUP received - reloading configuration
During authentication activity, the Lua backend then failed to resolve a target following an HTTP 404 response:
Error: lua: db-lua: Failed to resolve target
Shortly afterwards, the authentication process aborted with this assertion:
Panic: file sasl-server.c: line 67 (sasl_server_instance_unref): assertion failed: (sinst->requests == 0)
The master subsequently reported:
Error: master: service(auth): service(auth): child 4046828 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps)
The backtrace included the following functions:
sasl_server_instance_unref auth_sasl_instance_deinit auths_init auths_free auths_free main
The log:
Oct 15 00:29:41 dovecot[4050341]: auth-worker(<masked>,<masked>)<4050417><SpTTH9ZdIf7GhzdJ>: request [9]: Error: lua: db-lua: Failed to resolve target Oct 15 00:29:42 dovecot[4046755]: submission-login: Login aborted: Server shutting down (unfinished AUTH command) (auth failed, 27 attempts in 83 secs) (auth_failed): user=<masked>, method=LOGIN, rip=<masked>, rp=65057, lip=<masked>, Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: Panic: file sasl-server.c: line 67 (sasl_server_instance_unref): assertion failed: (sinst->requests == 0) Oct 15 00:29:42 dovecot[4046755]: auth: Error: Raw backtrace: #0 buffer_append[0x70a03bd47c67] -> #1 backtrace_append[0x70a03bd4804b] -> #2 backtrace_get[0x70a03bd48098] -> #3 i_set_failure_send_prefix[0x70a03bd52fb2] -> #4 i_syslog_error_handler[0x70a03bd540d5] -> #5 i_syslog_fatal_handler[0x70a03bd54152] -> #6 i_panic[0x70a03bd53058] -> #7 sasl_server_instance_unref[0x70a03bd14b76] -> #8 auth_sasl_instance_deinit[0x62869f9d22fa] -> #9 auths_init[0x62869f9c562e] -> #10 auths_free[0x62869f9c5691] -> #11 auths_free[0x62869f9c570e] -> #12 main[0x62869f9c5b54] -> #13 __libc_init_first[0x70a03b82a150] -> #14 __libc_start_main[0x70a03b82a200] -> #15 _start[0x62869f9c0370] Oct 15 00:29:42 dovecot[3842726]: master: Error: service(auth): service(auth): child 4046828 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2)
(IPs, emails and hostnames are masked or removed)
The error was triggered when some abusers tried to abuse submission-login at our public endpoint.
Context and questions The assertion occurred approximately 30 seconds after the configuration reload, while authentication attempts were being processed. The logs also show repeated Lua target-lookup failures. I have not established whether the crash requires a configuration reload, outstanding authentication requests, Lua lookup errors, or a combination of these conditions. Could you help determine:
- Whether this assertion is a known issue in Dovecot 2.4.x.
- Whether there are relevant fixes in a later release.
- What additional diagnostics would be useful to identify the cause?
I will provide the sanitized configuration, package details, and relevant logs. I can investigate reproduction conditions if needed. Thank you. Regards Liubov Pashkova Systems Engineer, Group.One
Kind regards, Liubov Pashkova Systems Engineer [group.one] group.one Carlsgatan 3 | 211 20 Malmö | Sweden
group.one<https://www.group.one> | LinkedIn<https://www.linkedin.com/company/group-dot-one/>
Hello Dovecot Team, I would like to report an authentication-process crash in Dovecot 2.4.5. Environment
o Dovecot version: 2.4.5
o Package: 2:2.4.5+dfsg1-2onehop1 (please confirm against the installed
package) - our internal custom build
o Operating system: Ubuntu 24.04 LTS (Noble)
o Service: Dovecot submission authentication
o Authentication backend: custom Lua authentication and target lookup
over HTTP
o Core dump: unavailable for this incidentObserved error On October 15, 2026, the following sequence appeared in the logs. First, Dovecot reloaded its configuration:
Oct 15 00:29:12 Warning: master: SIGHUP received - reloading configuration
During authentication activity, the Lua backend then failed to resolve a target following an HTTP 404 response:
Error: lua: db-lua: Failed to resolve target
Shortly afterwards, the authentication process aborted with this assertion:
Panic: file sasl-server.c: line 67 (sasl_server_instance_unref): assertion failed: (sinst->requests == 0)
The master subsequently reported:
Error: master: service(auth): service(auth): child 4046828 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps)
The backtrace included the following functions:
sasl_server_instance_unref auth_sasl_instance_deinit auths_init auths_free auths_free main The log:
Oct 15 00:29:41 dovecot[4050341]: auth-worker(<masked>,<masked>)<4050417><SpTTH9ZdIf7GhzdJ>: request [9]: Error: lua: db-lua: Failed to resolve target Oct 15 00:29:42 dovecot[4046755]: submission-login: Login aborted: Server shutting down (unfinished AUTH command) (auth failed, 27 attempts in 83 secs) (auth_failed): user=<masked>, method=LOGIN, rip=<masked>, rp=65057, lip=<masked>, Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: Panic: file sasl-server.c: line 67 (sasl_server_instance_unref): assertion failed: (sinst->requests == 0) Oct 15 00:29:42 dovecot[4046755]: auth: Error: Raw backtrace: #0 buffer_append[0x70a03bd47c67] -> #1 backtrace_append[0x70a03bd4804b] -> #2 backtrace_get[0x70a03bd48098] -> #3 i_set_failure_send_prefix[0x70a03bd52fb2] -> #4 i_syslog_error_handler[0x70a03bd540d5] -> #5 i_syslog_fatal_handler[0x70a03bd54152] -> #6 i_panic[0x70a03bd53058] -> #7 sasl_server_instance_unref[0x70a03bd14b76] -> #8 auth_sasl_instance_deinit[0x62869f9d22fa] -> #9 auths_init[0x62869f9c562e] -> #10 auths_free[0x62869f9c5691] -> #11 auths_free[0x62869f9c570e] -> #12 main[0x62869f9c5b54] -> #13 __libc_init_first[0x70a03b82a150] -> #14 __libc_start_main[0x70a03b82a200] -> #15 _start[0x62869f9c0370] Oct 15 00:29:42 dovecot[3842726]: master: Error: service(auth): service(auth): child 4046828 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2)
(IPs, emails and hostnames are masked or removed) The error was triggered when some abusers tried to abuse submission-login at our public endpoint.
Context and questions The assertion occurred approximately 30 seconds after the configuration reload, while authentication attempts were being processed. The logs also show repeated Lua target-lookup failures. I have not established whether the crash requires a configuration reload, outstanding authentication requests, Lua lookup errors, or a combination of these conditions. Could you help determine:
1. Whether this assertion is a known issue in Dovecot 2.4.x.
2. Whether there are relevant fixes in a later release.
3. What additional diagnostics would be useful to identify the cause?I will provide the sanitized configuration, package details, and relevant logs. I can investigate reproduction conditions if needed. Thank you. Regards Liubov Pashkova Systems Engineer, Group.One Kind regards, Liubov Pashkova Systems Engineer [1]group.one group.one Carlsgatan 3 | 211 20 MalmAP | Sweden
[2]group.one | [3]LinkedIn
References
Visible links 2. https://www.group.one/ 3. https://www.linkedin.com/company/group-dot-one/
And one more thing:
If it is published, can it be published anonymously without my name, email and company name?
From: Liubov Pashkova <liubov.pashkova@group.one> Sent: Friday, October 16, 2026 1:56 PM To: dovecot@dovecot.org <dovecot@dovecot.org> Subject: Auth panic after SIGHUP: sasl_server_instance_unref() assertion failed on Dovecot 2.4.5
Hello Dovecot Team, I would like to report an authentication-process crash in Dovecot 2.4.5. Environment
- Dovecot version: 2.4.5
- Package: 2:2.4.5+dfsg1-2onehop1 (please confirm against the installed package) - our internal custom build
- Operating system: Ubuntu 24.04 LTS (Noble)
- Service: Dovecot submission authentication
- Authentication backend: custom Lua authentication and target lookup over HTTP
- Core dump: unavailable for this incident
Observed error On October 15, 2026, the following sequence appeared in the logs. First, Dovecot reloaded its configuration:
Oct 15 00:29:12 Warning: master: SIGHUP received - reloading configuration
During authentication activity, the Lua backend then failed to resolve a target following an HTTP 404 response:
Error: lua: db-lua: Failed to resolve target
Shortly afterwards, the authentication process aborted with this assertion:
Panic: file sasl-server.c: line 67 (sasl_server_instance_unref): assertion failed: (sinst->requests == 0)
The master subsequently reported:
Error: master: service(auth): service(auth): child 4046828 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps)
The backtrace included the following functions:
sasl_server_instance_unref auth_sasl_instance_deinit auths_init auths_free auths_free main
The log:
Oct 15 00:29:41 dovecot[4050341]: auth-worker(<masked>,<masked>)<4050417><SpTTH9ZdIf7GhzdJ>: request [9]: Error: lua: db-lua: Failed to resolve target Oct 15 00:29:42 dovecot[4046755]: submission-login: Login aborted: Server shutting down (unfinished AUTH command) (auth failed, 27 attempts in 83 secs) (auth_failed): user=<masked>, method=LOGIN, rip=<masked>, rp=65057, lip=<masked>, Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: Panic: file sasl-server.c: line 67 (sasl_server_instance_unref): assertion failed: (sinst->requests == 0) Oct 15 00:29:42 dovecot[4046755]: auth: Error: Raw backtrace: #0 buffer_append[0x70a03bd47c67] -> #1 backtrace_append[0x70a03bd4804b] -> #2 backtrace_get[0x70a03bd48098] -> #3 i_set_failure_send_prefix[0x70a03bd52fb2] -> #4 i_syslog_error_handler[0x70a03bd540d5] -> #5 i_syslog_fatal_handler[0x70a03bd54152] -> #6 i_panic[0x70a03bd53058] -> #7 sasl_server_instance_unref[0x70a03bd14b76] -> #8 auth_sasl_instance_deinit[0x62869f9d22fa] -> #9 auths_init[0x62869f9c562e] -> #10 auths_free[0x62869f9c5691] -> #11 auths_free[0x62869f9c570e] -> #12 main[0x62869f9c5b54] -> #13 __libc_init_first[0x70a03b82a150] -> #14 __libc_start_main[0x70a03b82a200] -> #15 _start[0x62869f9c0370] Oct 15 00:29:42 dovecot[3842726]: master: Error: service(auth): service(auth): child 4046828 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2)
(IPs, emails and hostnames are masked or removed)
The error was triggered when some abusers tried to abuse submission-login at our public endpoint.
Context and questions The assertion occurred approximately 30 seconds after the configuration reload, while authentication attempts were being processed. The logs also show repeated Lua target-lookup failures. I have not established whether the crash requires a configuration reload, outstanding authentication requests, Lua lookup errors, or a combination of these conditions. Could you help determine:
- Whether this assertion is a known issue in Dovecot 2.4.x.
- Whether there are relevant fixes in a later release.
- What additional diagnostics would be useful to identify the cause?
I will provide the sanitized configuration, package details, and relevant logs. I can investigate reproduction conditions if needed. Thank you. Regards Liubov Pashkova Systems Engineer, Group.One
Kind regards, Liubov Pashkova Systems Engineer [group.one] group.one Carlsgatan 3 | 211 20 Malm? | Sweden
group.one<https://www.group.one> | LinkedIn<https://www.linkedin.com/company/group-dot-one/>
And one more thing: If it is published, can it be published anonymously without my name, email and company name?
From: Liubov Pashkova <liubov.pashkova@group.one> Sent: Friday, October 16, 2026 1:56 PM To: dovecot@dovecot.org <dovecot@dovecot.org> Subject: Auth panic after SIGHUP: sasl_server_instance_unref() assertion failed on Dovecot 2.4.5
Hello Dovecot Team, I would like to report an authentication-process crash in Dovecot 2.4.5. Environment
o Dovecot version: 2.4.5
o Package: 2:2.4.5+dfsg1-2onehop1 (please confirm against the installed
package) - our internal custom build
o Operating system: Ubuntu 24.04 LTS (Noble)
o Service: Dovecot submission authentication
o Authentication backend: custom Lua authentication and target lookup
over HTTP
o Core dump: unavailable for this incidentObserved error On October 15, 2026, the following sequence appeared in the logs. First, Dovecot reloaded its configuration:
Oct 15 00:29:12 Warning: master: SIGHUP received - reloading configuration
During authentication activity, the Lua backend then failed to resolve a target following an HTTP 404 response:
Error: lua: db-lua: Failed to resolve target
Shortly afterwards, the authentication process aborted with this assertion:
Panic: file sasl-server.c: line 67 (sasl_server_instance_unref): assertion failed: (sinst->requests == 0)
The master subsequently reported:
Error: master: service(auth): service(auth): child 4046828 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps)
The backtrace included the following functions:
sasl_server_instance_unref auth_sasl_instance_deinit auths_init auths_free auths_free main The log:
Oct 15 00:29:41 dovecot[4050341]: auth-worker(<masked>,<masked>)<4050417><SpTTH9ZdIf7GhzdJ>: request [9]: Error: lua: db-lua: Failed to resolve target Oct 15 00:29:42 dovecot[4046755]: submission-login: Login aborted: Server shutting down (unfinished AUTH command) (auth failed, 27 attempts in 83 secs) (auth_failed): user=<masked>, method=LOGIN, rip=<masked>, rp=65057, lip=<masked>, Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4050341]: auth-worker: [lua-auth] [init] script stopped Oct 15 00:29:42 dovecot[4046755]: auth: Panic: file sasl-server.c: line 67 (sasl_server_instance_unref): assertion failed: (sinst->requests == 0) Oct 15 00:29:42 dovecot[4046755]: auth: Error: Raw backtrace: #0 buffer_append[0x70a03bd47c67] -> #1 backtrace_append[0x70a03bd4804b] -> #2 backtrace_get[0x70a03bd48098] -> #3 i_set_failure_send_prefix[0x70a03bd52fb2] -> #4 i_syslog_error_handler[0x70a03bd540d5] -> #5 i_syslog_fatal_handler[0x70a03bd54152] -> #6 i_panic[0x70a03bd53058] -> #7 sasl_server_instance_unref[0x70a03bd14b76] -> #8 auth_sasl_instance_deinit[0x62869f9d22fa] -> #9 auths_init[0x62869f9c562e] -> #10 auths_free[0x62869f9c5691] -> #11 auths_free[0x62869f9c570e] -> #12 main[0x62869f9c5b54] -> #13 __libc_init_first[0x70a03b82a150] -> #14 __libc_start_main[0x70a03b82a200] -> #15 _start[0x62869f9c0370] Oct 15 00:29:42 dovecot[3842726]: master: Error: service(auth): service(auth): child 4046828 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2)
(IPs, emails and hostnames are masked or removed) The error was triggered when some abusers tried to abuse submission-login at our public endpoint.
Context and questions The assertion occurred approximately 30 seconds after the configuration reload, while authentication attempts were being processed. The logs also show repeated Lua target-lookup failures. I have not established whether the crash requires a configuration reload, outstanding authentication requests, Lua lookup errors, or a combination of these conditions. Could you help determine:
1. Whether this assertion is a known issue in Dovecot 2.4.x.
2. Whether there are relevant fixes in a later release.
3. What additional diagnostics would be useful to identify the cause?I will provide the sanitized configuration, package details, and relevant logs. I can investigate reproduction conditions if needed. Thank you. Regards Liubov Pashkova Systems Engineer, Group.One Kind regards, Liubov Pashkova Systems Engineer [1]group.one group.one Carlsgatan 3 | 211 20 Malmoe | Sweden
[2]group.one | [3]LinkedIn
References
Visible links 2. https://www.group.one/ 3. https://www.linkedin.com/company/group-dot-one/
participants (1)
-
Liubov Pashkova