- dovecot - dovecot.org

Bug report: deadlock with new doveadm protocol
by Patrick Cernko 21 Sep '26

21 Sep '26

Hi Dovecot developers, hi list, I think I found a bug in the new doveadm protocol using OSTREAM_MULTIPLEX_FORMAT_STREAM enabled in 2.4.5 (commit 16226f8021068cda43023982eca45f859164a2d9). For very specific mailboxes (so far I only found 2 users in our setup), the following command runs into a deadlock: doveadm sync -l 30 -u USERNAME tcp:OTHER_SERVER If I start the command with debugging enabled (-D), the command successfully finishes after less than a second (the mailbox is rather small). This looks to me like a race condition which is not triggered when enabling debug output (some call this a heisenbug). Both processes (doveadm and doveadm-server on the OTHER_SERVER) are hanging in epoll_wait(). To create a backtrace, I have sent a SIGSEGV to the processes, once on the source server, once on the other. This resulted in a coredump and termination of the other process due to EOF. Here are the backtraces of those coredumps: PID: 3975605 (doveadm) UID: REDACTED (REDACTED) GID: REDACTED (REDACTED) Signal: 11 (SEGV) Timestamp: Mon 2026-09-21 10:54:13 CEST (2h 19min ago) Command Line: $'doveadm [REDACTED recv_mailbox_tree_deletes]' Executable: /usr/bin/doveadm Control Group: /user.slice/user-0.slice/session-87057.scope Unit: session-87057.scope Slice: user-0.slice Session: 87057 Owner UID: 0 (root) Boot ID: e3d3c33d72164c98b58575bc3ad98ff5 Machine ID: ae0fa1dbcc7d4f4d9bb6ad7fcd1e072f Hostname: typhon Storage: /var/lib/systemd/coredump/core.doveadm.REDACTED.e3d3c33d72164c98b58575bc3ad98ff5.3975605.1789980853000000.zst (present) Size on Disk: 518.3K Message: Process 3975605 (doveadm) of user REDACTED dumped core. Module libuuid.so.1 from deb util-linux-2.41.5-0+deb13u1.amd64 Module libgcc_s.so.1 from deb gcc-14-14.2.0-19.amd64 Module libstdc++.so.6 from deb gcc-14-14.2.0-19.amd64 Module libzstd.so.1 from deb libzstd-1.5.7+dfsg-1.amd64 Stack trace of thread 3975605: #0 0x00007ff829f4f3a7 n/a (libc.so.6 + 0x8f3a7) #1 0x00007ff829f4f3cd n/a (libc.so.6 + 0x8f3cd) #2 0x00007ff829fd07ed epoll_wait (libc.so.6 + 0x1107ed) #3 0x00007ff82a370a85 io_loop_handler_run_internal (libdovecot.so.0 + 0x170a85) #4 0x00007ff82a370be4 io_loop_handler_run (libdovecot.so.0 + 0x170be4) #5 0x00007ff82a370de8 io_loop_run (libdovecot.so.0 + 0x170de8) #6 0x00005f60bd513b3d cmd_dsync_run_remote (/usr/bin/doveadm + 0x3ab3d) #7 0x00005f60bd51484b doveadm_mail_next_user (/usr/bin/doveadm + 0x3b84b) #8 0x00005f60bd516657 doveadm_mail_cmd_exec (/usr/bin/doveadm + 0x3d657) #9 0x00005f60bd52af99 doveadm_cmdline_run (/usr/bin/doveadm + 0x51f99) #10 0x00005f60bd52b122 doveadm_cmdline_try_run (/usr/bin/doveadm + 0x52122) #11 0x00005f60bd50317b main (/usr/bin/doveadm + 0x2a17b) #12 0x00007ff829ee9ca8 n/a (libc.so.6 + 0x29ca8) #13 0x00007ff829ee9d65 __libc_start_main (libc.so.6 + 0x29d65) #14 0x00005f60bd5034b1 _start (/usr/bin/doveadm + 0x2a4b1) ELF object binary architecture: AMD x86-64 PID: 1992428 (doveadm-server) UID: 0 (root) GID: REDACTED (REDACTED) Signal: 11 (SEGV) Timestamp: Mon 2026-09-21 10:58:35 CEST (2h 18min ago) Command Line: $'dovecot/doveadm-server [REDACTED REDACTED slave_recv_mailbox]' Executable: /usr/lib/dovecot/doveadm-server Control Group: /system.slice/dovecot.service Unit: dovecot.service Slice: system.slice Boot ID: fb737a07888046ab9be0656dbe6cb21f Machine ID: 2d9ee85474064e06aa796c67b8f11dd9 Hostname: tyche Storage: /var/lib/systemd/coredump/core.doveadm-server.0.fb737a07888046ab9be0656dbe6cb21f.1992428.1789981115000000.zst (present) Size on Disk: 497.5K Message: Process 1992428 (doveadm-server) of user 0 dumped core. Module libuuid.so.1 from deb util-linux-2.41.5-0+deb13u1.amd64 Module libgcc_s.so.1 from deb gcc-14-14.2.0-19.amd64 Module libstdc++.so.6 from deb gcc-14-14.2.0-19.amd64 Module libzstd.so.1 from deb libzstd-1.5.7+dfsg-1.amd64 Stack trace of thread 1992428: #0 0x000079838fdab3a7 n/a (libc.so.6 + 0x8f3a7) #1 0x000079838fdab3cd n/a (libc.so.6 + 0x8f3cd) #2 0x000079838fe2c7ed epoll_wait (libc.so.6 + 0x1107ed) #3 0x0000798390170a85 io_loop_handler_run_internal (libdovecot.so.0 + 0x170a85) #4 0x0000798390170be4 io_loop_handler_run (libdovecot.so.0 + 0x170be4) #5 0x0000798390170de8 io_loop_run (libdovecot.so.0 + 0x170de8) #6 0x000059f13b7bdcce cmd_dsync_server_run (/usr/lib/dovecot/doveadm-server + 0x39cce) #7 0x000059f13b7bf74b doveadm_mail_next_user (/usr/lib/dovecot/doveadm-server + 0x3b74b) #8 0x000059f13b7c1557 doveadm_mail_cmd_exec (/usr/lib/dovecot/doveadm-server + 0x3d557) #9 0x000059f13b7d55b9 doveadm_cmdline_run (/usr/lib/dovecot/doveadm-server + 0x515b9) #10 0x000059f13b7d8232 doveadm_cmd_server_run_ver2 (/usr/lib/dovecot/doveadm-server + 0x54232) #11 0x000079839016ecdb io_loop_call_io (libdovecot.so.0 + 0x16ecdb) #12 0x0000798390170b1b io_loop_handler_run_internal (libdovecot.so.0 + 0x170b1b) #13 0x0000798390170be4 io_loop_handler_run (libdovecot.so.0 + 0x170be4) #14 0x0000798390170de8 io_loop_run (libdovecot.so.0 + 0x170de8) #15 0x00007983900b84be master_service_run (libdovecot.so.0 + 0xb84be) #16 0x000059f13b7ae307 main (/usr/lib/dovecot/doveadm-server + 0x2a307) #17 0x000079838fd45ca8 n/a (libc.so.6 + 0x29ca8) #18 0x000079838fd45d65 __libc_start_main (libc.so.6 + 0x29d65) #19 0x000059f13b7ae3b1 _start (/usr/lib/dovecot/doveadm-server + 0x2a3b1) ELF object binary architecture: AMD x86-64 The doveconf -n output is attached. As a temp. workaround, I have disabled multiplex stream for the doveadm protocol by: --- dovecot-2.4.5.orig/src/lib-doveadm/doveadm-protocol.h +++ dovecot-2.4.5/src/lib-doveadm/doveadm-protocol.h @@ -16,7 +16,7 @@ #define DOVEADM_PROTOCOL_MIN_VERSION_EXTRA_FIELDS 3 /* Use the (non-deprecated) STREAM multiplex format instead of PACKET for the server -> client output. */ -#define DOVEADM_PROTOCOL_MIN_VERSION_MULTIPLEX_STREAM 4 +#define DOVEADM_PROTOCOL_MIN_VERSION_MULTIPLEX_STREAM 5 #define DOVEADM_EX_NOTFOUND EX_NOHOST #define DOVEADM_EX_NOTPOSSIBLE EX_DATAERR This allows us to continue the service for our users but obviously is not a solution. Unfortunately I cannot provide the data of the affected mailboxes to allow reproducing the bug. But I have saved them on a development system and can reproduce it locally. I'm willing to test suggested patches and provide more data (unless restricted by privacy issues). Can anyone help me debugging this issue? Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

1 0

Re: 2.4.5 causes an infinite loop in maildir_is_internal_name
by Johannes Nohl 21 Sep '26

21 Sep '26

Dear Naofumi Honda, unfortunately I don't have your email. I found - rather by surprise - that mail_driver is case-sensitiv; Maildir is like Auto like auto. The work around is stating "mail_driver = maildir" not "= Maildir". This is a reply to your config as described here: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/message/TV5O… Please try. -- Johannes Nohl

2 1

Quota messages warning
by Alberto 21 Sep '26

21 Sep '26

I have dovecot 2.4.5 in a Docker container and warning quota of message count isn't working. My quota config: quota "User quota" { driver = count quota_warning warn-espacio-95 { quota_storage_percentage = 95 execute quota-warning { args = espacio-95 %{user} } } quota_warning warn-mensajes-95 { quota_message_percentage = 95 execute quota-warning { args = cantidad-95 %{user} } } quota_warning warn-espacio-85 { quota_storage_percentage = 85 execute quota-warning { args = espacio-85 %{user} } } quota_warning warn-mensajes-85 { quota_message_percentage = 85 execute quota-warning { args = cantidad-85 %{user} } } quota_warning warn-espacio-75 { quota_storage_percentage = 75 execute quota-warning { args = espacio-75 %{user} } } quota_warning warn-mensajes-75 { quota_message_percentage = 75 execute quota-warning { args = cantidad-75 %{user} } } } In storage option works ok, but in case of messages no event success. Log not show anything and external script is not call, of course. Any idea? Best Regards, Alberto

4 10

Variable expansion syntax: Filter "default" throws error (unwanted)
by Johannes Nohl 20 Sep '26

20 Sep '26

I am using dovecot 2.4.2 (almost) with new config language and I have a working configuration. However, the check for disabled users throws permanently errors in the log file, whenever a user is missing the ldap attribute for disabled. This is - in my view - due to a misfunction of Filter "default". passdb ldap { driver = ldap ldap_bind = yes ldap_filter = (&(|(objectClass=posixAccount)(objectClass=mailAccount))(uid=%{user})) fields { user = %{ldap:uid} nologin = %{ldap:shadowInactive | default(null)} reason = The account for this email address is disabled. } } This results in the following log line: 2026-03-31T00:46:31.102690+02:00 mailserver dovecot: auth(test,ipv4,sasl:plain)<YE81n0VOVuofEeSD>: Error: ldap: auth_passdb_post settings: Failed to parse configuration: Failed to expand passdb_fields/nologin setting variables: ldap: No such attribute 'shadowinactive' The right behaviour would be no logging on login success. Because the Filter "default" is intended to suppress any errors ("When value is missing or empty, you can use the default filter to provide value. Missing variables will cause errors and must be negated with default. This does not apply to all providers, some providers return empty when value is missing."). https://doc.dovecot.org/2.4.2/core/settings/variables.html#variable-expansi… As you may have seen I had to borrow null-value from sql db config also to make nologin ignoring a non present attribute. This is undocumented obviously. Instead, a non-working tip is provided ("Changed: 2.4.0 Extra fields can now also be set to empty string, "). However, the following does not work: "nologin = {ldap:shadowinactive | default("")}". https://doc.dovecot.org/2.4.2/core/settings/variables.html Also, the documentation is missing/hiding the part which explains that "default()" can be used to avoid error logs. PR regarding the documentation source is sent already. See "Fails if the attribute is not present, unless the ` <missing part>" https://doc.dovecot.org/2.4.0/core/config/auth/databases/ldap.html#ldap-spe… Is there another way to verify if account is disabled? -- Johannes Nohl postmaster i-t-cloud -- Johannes Nohl postmaster(a)i-t-cloud.de I am using dovecot 2.4.2 (almost) with new config language and I have a working configuration. However, the check for disabled users throws permanently errors in the log file, whenever a user is missing the ldap attribute for disabled. This is - in my view - due to a misfunction of Filter "default". passdb ldap { driver = ldap ldap_bind = yes ldap_filter = (&(|(objectClass=posixAccount)(objectClass=mailAccount))(uid=%{user})) fields { user = %{ldap:uid} nologin = %{ldap:shadowInactive | default(null)} reason = The account for this email address is disabled. } } This results in the following log line: *2026-03-31T00:46:31.102690+02:00 mailserver dovecot: auth(test,ipv4,sasl:plain)<YE81n0VOVuofEeSD>: Error: ldap: auth_passdb_post settings: Failed to parse configuration: Failed to expand passdb_fields/nologin setting variables: ldap: No such attribute 'shadowinactive' The right behaviour would be no logging on login success. Because the Filter "default" is intended to suppress any errors ("When value is missing or empty, you can use the default filter to provide value. Missing variables will cause errors and must be negated with default. This does not apply to all providers, some providers return empty when value is missing."). https://doc.dovecot.org/2.4.2/core/settings/variables.html#variable-expansi… As you may have seen I had to borrow null-value from sql db config also to make nologin ignoring a non present attribute. This is undocumented obviously. Instead, a non-working tip is provided ("Changed: 2.4.0 Extra fields can now also be set to empty string, "). However, the following does not work: "nologin = {ldap:shadowinactive | default("")}". https://doc.dovecot.org/2.4.2/core/settings/variables.html Also, the documentation is missing/hiding the part which explains that "default()" can be used to avoid error logs. PR regarding the documentation source is sent already. See "Fails if the attribute is not present, unless the ` <missing part>" https://doc.dovecot.org/2.4.0/core/config/auth/databases/ldap.html#ldap-spe… Is there another way to verify if account is disabled? -- Johannes Nohl postmaster i-t-cloud -- Johannes Nohl postmaster(a)i-t-cloud.de

2 2

Push Notification on 2.4.5
by horst.simon2＠icloud.com 19 Sep '26

19 Sep '26

Hi, Is there any simple explanation on how to enable and verify push notifications on dovecot 2.4.5. I am using eM Client on IOS and it uses push notification, but it does not receives any notification about new emails. I assume by default push notifications is not enabled. Any information appreciated. Regards, Horst

7 11

Dovecot and Pigeonhole v2.4.5 released
by Aki Tuomi 18 Sep '26

18 Sep '26

Hi! We are happy to publish version 2.4.5 of Dovecot and Pigeonhole. These contain CVEs, discovered by external researches. The majority of these have been discovered with help of automated code analysis tools like claude code security, which is why some of these are rather old, missed bugs. Distributions have changed - Jammy (Ubuntu 22.04) is no longer provided in repo.dovecot.org - Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org No new dependencies have been added. Note that there are experimental features in 2.4, one is enabled with `--enable-experimental-mail-utf8`, and another with `--enable-experimental-imap4rev2`, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config. https://dovecot.org/releases/2.4/dovecot-2.4.5.tar.gz https://dovecot.org/releases/2.4/dovecot-2.4.5.tar.gz.sig https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.5.tar.gz https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.5.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot --- * CVE-2026-27852: Messages with a huge number of From/To/Cc/etc email addresses could result in excessive memory usage. * CVE-2026-33263: Submission: Login service crashes with panic once mail_max_userip_connections limit is reached. * CVE-2026-33604: The SMTP outbound dot-stuffing mechanism does not properly escape dots following a bare \r in message bodies, potentially allowing spoofed emails via malicious end-of-DATA injection. * CVE-2026-33606: Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. * CVE-2026-33607: IMAP LIST command could be used to cause excessive CPU usage. * CVE-2026-40014: IMAP THREAD command could have used excessive amount of CPU processing a single email with a massive number of Message-IDs in References header. * CVE-2026-40015: Invalid IMAP command sent to imap-hibernate process might crash it. * CVE-2026-40017: IMAP THREAD command could have used excessive amount of CPU processing emails with a large number of specially crafted Message-IDs in References header. The fix requires a new dovecot.index.thread file format, which is enabled only after setting dovecot_storage_version or newer. This rebuilds the index, so it will cause some extra CPU usage and extra metacache disk IO usage. It shouldn't cause (much) extra object storage IO, because all the fields should be coming from dovecot.index.cache. * CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker could send mails into a victim's mailbox and observe network traffic to determine whether a secret message matched a known string by comparing compressed response sizes (a CRIME-style attack). The fix resets the compression dictionary after each IMAP command, preventing information from leaking between commands. * CVE-2026-40205: If multiple OAUTH scopes were required, then this could have been only partially enforced with certain configurations. * CVE-2026-4200: XCLIENT FORWARD allows to forward key only passdb fields without the "forward_" prefix which allows connections from trusted networks to set nopasswd field which allows to skip the authentication. * CVE-2026-42391: Pre-login IMAP ID command could have used excessive amount of memory, causing the process to become killed and disconnecting all the other IMAP connections being proxied by the process. Or alternatively it could have caused excessive CPU usage, slowing down all the other IMAP connections being proxied by the process. * CVE-2026-42392: If URLAUTH is enabled, sending an invalid IMAP URLFETCH can result in an untagged NO response containing uninitialized memory, potentially leaking sensitive data. * CVE-2026-42393: Doveadm password length or API key length could still be determined via timing based attacks. * CVE-2026-42395: XCLIENT FORWARD command from login_trusted_networks could have been used to cause login processes to crash. * CVE-2026-52681: Sieve resource usage (sieve_max_cpu_time) was tracked in the active Sieve binary. Switching to a different active binary could have been used to reset (bypass) the resource usage. * CVE-2026-52687: Using IMAP COMPRESS ZSTD command can cause excessive memory usage in imap-login process, possibly making it reach vsz_limit and kill all the connections being served by the process. Fixed by disabling COMPRESS command with all other compression algorithms than the standard DEFLATE. * CVE-2026-73208: In oauth2, scope/aud checking was done with JWT tokens. Now it requires all scopes. * CVE-2026-73209: Sending IMAP COMPRESS package containing zero-length frames crashes imap or imap-login process. * auth: SIGHUP no longer flushes the passdb cache and SIGUSR2 no longer logs cache statistics. Use "doveadm auth cache flush" and the new "doveadm auth cache status" instead. * auth: The OTP authentication mechanism, the {OTP} password scheme and the passdb set-credentials support have been removed. They were unmaintained and unused. This also drops the passdb_sql_update_query setting. * config: doveconf no longer prints a flat global setting when a top-level named filter overrides the same setting. * doveadm: The doveadm protocol has been bumped to v1.4. The server uses the newer multiplex stream format with clients supporting it. Older clients keep working unchanged. * imap: Change imap_compress_on_proxy default to yes. * lib-dict-extra: Increase dict client request timeout from 30s to 65s, so it stays above the SQL/Cassandra query timeout. * lib-http: HTTP requests are now parsed strictly: obsolete line folding (obs-fold) and a bare LF line terminator are rejected. Both are request desynchronization/smuggling risks. HTTP responses are still parsed leniently. * lib-storage: A '~' in a mailbox name is now escaped only when it is at the beginning of the mailbox name, not at the beginning of every hierarchy part. Directories written by older versions are migrated automatically while listing mailboxes. * lib-var-expand: Add %{time:unix} provider and the epoch, from_epoch, date, iso8601 and escape filters. Deprecates the old time providers. * lib-var-expand: The safe filter must now be the last filter in the chain. * master: Increase the timeout after config reload before killing still running old processes from 6s to 35s, so that lib-master can stop them gracefully first. + config: Support heredoc syntax for multi-line setting values: key = <<EOD ... EOD. doveconf now outputs inline SET_FILE contents (e.g. ssl_ca) using heredoc instead of the "inline:" prefix. The "inline:" form is still accepted. + configure: Build imap-hibernate also when only kqueue notify is available. + doveadm: Add "doveadm auth cache status" command, with --reset for clearing the counters. + doveadm: dump - List all supported dump types, and print the key type also for KEM and unsupported keys. + fts-flatcurve: Add support for phrase searching. This fixes false positives where the searched words existed, but not as a phrase. + fts-flatcurve: Delete the FTS index directory also when a Maildir mailbox is deleted. + imap: Add [THROTTLED] response code to tagged replies when a plugin has throttled the command. + last-login: Add last_login_dict_fields setting for updating multiple dictionary fields at login. + lib-dcrypt: Add ML-KEM-512/768/1024 support with OpenSSL 3. + lib-dcrypt: Support AEAD with Dovecot key encryption. + lib-settings: Expand %{variables} also in strlist and boollist keys. + lib-sql: sqlite - Add sqlite_busy_timeout setting, default 1s. + login-common: Log the destination also when a proxy connection fails. + quota: Update quota-clone also when "doveadm quota recalc" is run. - Fix building on systems with a signed 32-bit time_t. - Fix building with Lua when LUA_LIBS contains linker flags such as -L. - anvil: Fix busy loop eating CPU after an admin socket connection was disconnected. - auth: Fix authentication failing after a password change when the passdb cache entry was verified by an auth worker. - auth: Fix the credentials scheme of one passdb leaking into the next one during a multi-passdb lookup. - auth: oauth2 - Fix losing userdb_* fields during OAUTHBEARER authentication. - auth: passwd-file - Fix %{passdb:...} and %{userdb:...} expansion returning garbage or crashing. - config: Fix crash in "doveconf -f" for a filter that includes a @group. - config: Fix crash when including a default @group into a filter. - config: Fix hiding secrets in doveconf output. - config: Fix startup failures with some settings containing %{variables}. - configure: Fix BUILD_IMAP_HIBERNATE detection. - doc: solr-schema-9.xml - Add the mandatory tokenizer class attribute. - doveadm: compress-connect - Fix writing server input to a non-blocking stdout. - doveadm: fs delete - Fix crash with concurrent async deletes. - doveconf: Fix bogus "Multiple settings matched" error when stdout is redirected to a file that already has content. - dsync: Fix truncating a mailbox attribute value when it is compared to the local one, e.g. truncating a Sieve script. - dsync: backup - Mailbox attributes changed or created only in the destination are now reverted or deleted. - fts-flatcurve: Ignore index directory entries that vanish during iteration. - fts: Don't run FTS optimize on forced resync. - fts: build-mail - Fix accessing Content-Type header buffer out of bounds. - imap-login, pop3-login: Tolerate SASL continuations "+" without a trailing space when proxying authentication. - imap: Don't report FETCH output stream errors as "BUG: Unknown internal error". - imap: Fix hibernation always failing on FreeBSD. - imap: Fix panic on GETMETADATA with an invalid UTF-8 mailbox pattern. - imapc: Don't send SEEEN/UNSEEN to the remote server when private indexes are used. - imapc: Fix SEARCH results pointing at wrong messages after an untagged EXPUNGE. - imapc: Fix SORT returning an empty result when search criteria were used. - imapc: Fix crash when copying a mail that was already expunged in the source mailbox. - imapc: Fix stale SEARCH/SORT results after a STORE in the same session. - imapc: Honor imapc_features=no-search also for SORT. - imapc: Properly handle search criteria that can be sent to remote server. - lib-dcrypt: Don't panic on key algorithms the backend doesn't support. - lib-dcrypt: Fix x9.62 ECDSA signatures randomly failing verification. - lib-dict-backend: cdb - Fix use-after-free of the returned key. - lib-dns-client: Fix handling of a disconnect initiated by the dns-client service. - lib-fs: Fix panic in fs_write_stream_abort(), e.g. when the disk is full during FTS indexing. - lib-index: Fix "File is already open" error when appending to the transaction log while another process is rotating it. This showed up as "NO [SERVERBUG] Internal error occurred." without any logging. - lib-ldap: Fall back to system default CA paths, needed for OpenLDAP built against GnuTLS. - lib-mail: istream-binary-converter - Fix heap use-after-free with a bodyless MIME part. - lib-mail: message-parser - Fix out of bounds read with an empty preamble, fix skipping the epilogue boundary line, and degrade to a re-parse instead of panicking with an inconsistent cached MIME tree. - lib-master: Fix kick reason when the KICK-USER-SIGNAL command arrives late, which logged "Killed with signal 15" instead of "User kicked". - lib-oauth2: jwt - Fix use-after-realloc, guard against an empty body segment and percent-encode bare "." and ".." identifiers. - lib-program-client: Fix panic upon irregular termination. - lib-settings: Fix sorting of the settings history, which caused changed defaults and renames to be ignored once a plugin registered its own history, if dovecot_config_version has been set to greater than 2.4.0. - lib-smtp: Fix assert with an empty broken localpart. - lib-smtp: xclient - Reject an invalid HELO parameter with 501. - lib-sql: pgsql - Fix binary field values for rows after the first. This mainly affected dict-sql maps with hexblob fields. - lib-ssl-iostream: Fix crash at process exit with OpenSSL 4.0. - lib-storage: Don't log an error when the client resets the connection while saving a mail. - lib-storage: Fix crash when reverting a failed mailbox deletion. - lib-storage: Fix decoded size calculation for base64 attachments, which could delete the cache record of a mail with a detached attachment. - lib-storage: Fix handling escaped mailbox names in the mailbox list index. - lib-storage: Fix rewriting non-NFC subscriptions with mUTF-7 storage names, which caused repeated rename errors. - lib-storage: Fix searching flags when the view is not up to date. This broke e.g. a pipelined UID STORE +FLAGS \Deleted followed by UID EXPUNGE. - lib-storage: Fix the mailbox vsize header not being repaired when it is corrupted, causing wrong mailbox sizes to be reported. - lib-storage: thread - Fix panic when running IMAP THREAD in multiple connections in parallel. - lib-var-expand: Reject an empty separator in the index filter, which caused an infinite loop. - lib: Fix crash and out of bounds reads when decoding IDN addresses. Reachable only with the experimental mail UTF-8 support enabled. - lib: ioloop - Fix panic and delayed timeouts when time moves forwards. - lib: ostream-multiplex - Fix stalls, busy loops and a panic when streaming data through a multiplexed connection, e.g. IMAP FETCH through a login proxy or TLS connections. - login-common: Fix connection hanging if an ostream write failed. This happened at least with HAProxy health check connections. - login-common: Fix real_remote_ip being looked up incorrectly. - login-common: Reject proxy credentials with ASCII control characters. - login-proxy: Fix "doveadm kick" for proxied connections in high-security mode, and log "Kicked by admin" as the reason. - maildir: Fix random SEARCH failures when another session concurrently expunges mails. - quota: Fix maildir quota dropping to zero after IMAP MOVE or REPLACE. - submission-login: proxy - Fix crash and unbounded memory usage with a multi-line or malformed AUTH reply from the backend. --- * CVE-2026-33605: managesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. * CVE-2026-40019: v2.4.3 regression: managesieve-login pre-auth infinite loop. An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. * CVE-2026-42007: sieve-editheader: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer in the delivered mail. * lib-sieve: sieve_max_cpu_time now defaults to 30s globally, so the limit also applies to MDA delivery. Previously the global default was unlimited and only imap_sieve used 30s. The old defaults are kept for older dovecot_config_version values. * lib-sieve: enotify - The number of notify actions performed during a single script execution is now limited to 10 by default. See the new sieve_notify_max_notifications setting. * lib-sieve: enotify - A single "mailto:" notify action is now limited to 8 recipients and 16 additional headers by default. See the new sieve_notify_mailto_max_recipients and sieve_notify_mailto_max_headers settings. * imap-filter-sieve: FILTER SIEVE SCRIPT literals larger than sieve_max_script_size are now rejected before the script is read. - lib-sieve: Fix stack overflow occurring when a script requires the same extension repeatedly. - lib-sieve: encoded-character - Fix integer overflow parsing ${unicode:...} values with 9 or more hex digits. - lib-sieve: variables - Fix integer overflow parsing numeric variable index. - lib-sieve: regex - Fix panic occurring when more than 8 group values are matched. - lib-sieve: ldap - Fix LDAP settings missing from the LDAP storage plugin. - managesieve-login: Fix capability reporting when Sieve settings use %variables.

6 12

2.4.5 Segmentation fault when sieve dir exists, but there is no personal script
by inaugurator＠ya.ru 17 Sep '26

17 Sep '26

Hi guys, with config ``` sieve_script personal { driver = file path = ~/sieve active_path = ~/.dovecot.sieve } ``` there can be ~/sieve dir, but no script file. The situation leads to SIGSEGV, Segmentation fault. ``` (gdb) bt #0 0x00007fd1604dfc03 in sieve_script_binary_read_metadata (script=0x0, sblock=sblock@entry=0x603d08ce4ef0, offset=offset@entry=0x7fff8dab6150) at sieve-script.c:530 #1 0x00007fd16051b63c in ext_include_binary_open (ext=0x603d08cc7eb0, sbin=0x603d08ce4758, context=0x603d08ce5018) at ext-include-binary.c:409 #2 0x00007fd1604ea7af in sieve_binary_open (svinst=<optimized out>, path=<optimized out>, script=script@entry=0x603d08ce23f8, sbin_r=<optimized out>, error_code_r=<optimized out>, error_code_r@entry=0x7fff8dab6344) at sieve-binary-file.c:940 #3 0x00007fd1604e0765 in sieve_script_binary_load_default (script=0x603d08ce23f8, path=<optimized out>, sbin_r=<optimized out>) at sieve-script.c:691 #4 0x00007fd1604e0803 in sieve_script_binary_load (script=script@entry=0x603d08ce23f8, sbin_r=sbin_r@entry=0x7fff8dab63b8, error_code_r=<optimized out>, error_code_r@entry=0x7fff8dab64dc) at sieve-script.c:716 #5 0x00007fd16050b7ed in sieve_open_script_real (error_code_r=0x7fff8dab64dc, sbin_r=0x7fff8dab6420, flags=SIEVE_COMPILE_FLAG_NO_ENVELOPE, ehandler=0x603d08cc9e98, script=0x603d08ce23f8) at sieve.c:451 #6 sieve_open_script (script=script@entry=0x603d08ce23f8, ehandler=ehandler@entry=0x603d08cc9e98, flags=flags@entry=SIEVE_COMPILE_FLAG_NO_ENVELOPE, sbin_r=sbin_r@entry=0x7fff8dab6420, error_code_r=<optimized out>, error_code_r@entry=0x7fff8dab64dc) at sieve.c:531 #7 0x00007fd160c2b2a6 in imap_sieve_run_open_script (isrun=isrun@entry=0x603d08ce1de8, rscript=rscript@entry=0x603d08ce1c60, cpflags=cpflags@entry=SIEVE_COMPILE_FLAG_NO_ENVELOPE, error_code_r=error_code_r@entry=0x7fff8dab64dc, recompile=false) at imap-sieve.c:641 #8 0x00007fd160c2c54d in imap_sieve_run_scripts (fatal_r=0x7fff8dab66cb, scriptenv=0x7fff8dab6580, msgdata=0x7fff8dab6540, isrun=0x603d08ce1de8) at imap-sieve.c:847 #9 imap_sieve_run_mail (isrun=0x603d08ce1de8, mail=<optimized out>, changed_flags=<optimized out>, fatal_r=fatal_r@entry=0x7fff8dab66cb) at imap-sieve.c:1018 #10 0x00007fd160c2e810 in imap_sieve_mailbox_transaction_run (changes=<optimized out>, dest_box=<optimized out>, ismt=0x603d08ce1fe8) at imap-sieve-storage.c:691 #11 imap_sieve_mailbox_transaction_commit (t=<optimized out>, changes_r=<optimized out>) at imap-sieve-storage.c:774 #12 0x00007fd16102f013 in quota_mailbox_transaction_commit () from /usr/lib/dovecot/modules/lib10_quota_plugin.so #13 0x00007fd16104d14a in acl_transaction_commit () from /usr/lib/dovecot/modules/lib01_acl_plugin.so #14 0x00007fd1640648d7 in mailbox_transaction_commit_get_changes () from /usr/lib/dovecot/libdovecot-storage.so.0 #15 0x0000603d088f0660 in cmd_append_finish_parsing () #16 0x0000603d088f0d56 in cmd_append_parse_new_msg () #17 0x0000603d088f1190 in cmd_append_continue_message () #18 0x0000603d0890a569 in command_exec () #19 0x0000603d088eebd7 in client_input_append () #20 0x00007fd163be7db7 in io_loop_call_io () from /usr/lib/dovecot/libdovecot.so.0 #21 0x00007fd163beb469 in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 #22 0x00007fd163be8066 in io_loop_handler_run () from /usr/lib/dovecot/libdovecot.so.0 #23 0x00007fd163be7f19 in io_loop_run () from /usr/lib/dovecot/libdovecot.so.0 #24 0x00007fd163abc8be in master_service_run () from /usr/lib/dovecot/libdovecot.so.0 #25 0x0000603d08921c54 in main () ``` Thank you for any help!

1 0

open(/proc/self/io) failed: Permission denied
by horst.simon2＠icloud.com 17 Sep '26

17 Sep '26

My sieve scripts don't get executed and when I enable debug logging I get following errors in the log: Sep 17 20:43:04 imap(username)<13827><3lXZcqtbpcHAqHUF>: Debug: Loading modules from directory: /opt/lib/dovecot Sep 17 20:43:04 imap(username)<13827><3lXZcqtbpcHAqHUF>: Debug: Module loaded: /opt/lib/dovecot/lib15_notify_plugin.so Sep 17 20:43:04 imap(username)<13827><3lXZcqtbpcHAqHUF>: Debug: Module loaded: /opt/lib/dovecot/lib20_push_notification_plugin.so Sep 17 20:43:04 imap(username)<13827><3lXZcqtbpcHAqHUF>: Debug: Module loaded: /opt/lib/dovecot/lib95_imap_sieve_plugin.so Sep 17 20:43:04 imap(username)<13827><3lXZcqtbpcHAqHUF>: Debug: Effective uid=5000, gid=5000, home=/share/CACHEDEV1_DATA/mail/<domainnamee>/<user> Sep 17 20:43:04 imap(horst(a)hbsimon.net)<13827><3lXZcqtbpcHAqHUF>: Debug: open(/proc/self/io) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +r perm: /proc/self/io) Dovecot version is 2.4.5 Is there anything I can change in the permissions to get this working?

4 9

problems restarting dovecot from cron: stderr not dup2()ed
by Thomas Klausner 15 Sep '26

15 Sep '26

Hi! I'm using dovecot-2.3.21.1 from pkgsrc on NetBSD 11.99.8/x86_64. I use certbot to handle dovecot's TLS certificate, and since I haven't implemented a nicer method yet, I restart dovecot weekly from cron to make sure it has the newest certificate. The symptom I see is that the restart doesn't finish until the next restart a week later - only then the previous restart's cron job "finishes" and I get an email. In a discussion on the NetBSD mailing list[1], RVP diagnosed it as follows: --- begin quote --- cron is still waiting for output from dovecot: 1. dovecot doesn't dup2() its STDERR_FILENO[2]--prolly to spew out error msgs. 2. when cron runs a crontab command, it dup2(STDOUT, STDERR)s the cmds stdout and stderr. 3. then it reads from this combined output and write()s this to sendmail's stdin. 4. all this works if either a) the program dies (ie. is not a daemon) so that cron can close sendmail's stdin.; or b) the daemon itself closes its stderr so an EOF can be generated when stdout is exhausted. 5. neither a) nor b) are satisfied in this case, so cron is still waiting for output which'll never arrive. 6. a week later, `service dovecot restart' kills the still running dovecot so cron can now "complete" the job and generate the email. --- end quote --- Can you please change dovecot to also dup(2) stderr to fix this? Thank you, Thomas [1] https://mail-index.netbsd.org/current-users/2026/09/13/msg047887.html [2]: https://github.com/dovecot/core/blob/main/src/master/main.c#L931

1 0

Issues after upgrading to the 2.4.* tree
by Kevin N Carpenter 15 Sep '26

15 Sep '26

Hi all. I've been running a Gentoo based mail server for decades - yeah, really! I usually upgrade it about once a year, which I just did. Been using the older dovecot versions until 2.4.5 got pulled in. Under Dovecot 2.3, I simply had the statement: *mail_location = maildir:~/.maildir* In dovecot/conf.d/10-mail and everything has been working. Ungraded my system and along comes 2.4 which changes configuration up. Using their converter, they suggest: *mail_driver = maildir mail_path = ~/.maildir * returns the error: /mail dovecot: imap(ccgllc)<5839><6sozAX5bskysEAQB>: Error: Namespace inbox: mail_storage settings: Failed to parse configuration: Invalid setting mail_path=~/.maildir: mail_path setting used home directory (~/) but there is no mail_home and userdb didn't return it / Setting *mail_home = /home/%{user}* gets closer, but then dovecot has permission errors reading the .maildir directory: /mail dovecot: imap(kevinc)<5541><6HubuX1bV42sEAQB>: Error: maildir: stat(/home/kevinc/.maildir/tmp) failed: Permission denied (euid=5000(<unknown>) egid=5000(<unknown>) missing +x perm: /home/kevinc/.maildir, dir owned by 1000:1000 mode=0700)/ Been going in circles for hours over this... all I want is a nice simply mairdir based imap server. btw - have SSL working just fine now. just added: *passdb pam { driver = pam pam_service_name = * } userdb passwd { driver = passwd } * since passdb and userdb were specified in my old configuration. Now getting: /auth-worker(kevinc,172.16.4.1)<5973></2FNPn5b1YqsEAQB>: request [1]: Error: pam: pam_authenticate() failed: Authentication failure (/etc/pam.d/* missing?/ /etc/pam.d/ exist, including the new dovecot statement. In any case, that last step feels like I am going backwards. Help please. Hi all. I've been running a Gentoo based mail server for decades - yeah, really! I usually upgrade it about once a year, which I just did. Been using the older dovecot versions until 2.4.5 got pulled in. Under Dovecot 2.3, I simply had the statement: mail_location = maildir:~/.maildir In dovecot/conf.d/10-mail and everything has been working. Ungraded my system and along comes 2.4 which changes configuration up. Using their converter, they suggest: mail_driver = maildir mail_path = ~/.maildir returns the error: mail dovecot: imap(ccgllc)<5839><6sozAX5bskysEAQB>: Error: Namespace inbox: mail_storage settings: Failed to parse configuration: Invalid setting mail_path=~/.maildir: mail_path setting used home directory (~/) but there is no mail_home and userdb didn't return it Setting mail_home = /home/%{user} gets closer, but then dovecot has permission errors reading the .maildir directory: mail dovecot: imap(kevinc)<5541><6HubuX1bV42sEAQB>: Error: maildir: stat(/home/kevinc/.maildir/tmp) failed: Permission denied (euid=5000(<unknown>) egid=5000(<unknown>) missing +x perm: /home/kevinc/.maildir, dir owned by 1000:1000 mode=0700) Been going in circles for hours over this... all I want is a nice simply mairdir based imap server. btw - have SSL working just fine now. just added: passdb pam { driver = pam pam_service_name = * } userdb passwd { driver = passwd } since passdb and userdb were specified in my old configuration. Now getting: auth-worker(kevinc,172.16.4.1)<5973></2FNPn5b1YqsEAQB>: request [1]: Error: pam: pam_authenticate() failed: Authentication failure (/etc/pam.d/* missing? /etc/pam.d/ exist, including the new dovecot statement. In any case, that last step feels like I am going backwards. Help please.

1 0