Your message dated Sun, 27 Sep 2026 02:34:04 +0000
with message-id <[email protected]>
and subject line Bug#1148937: fixed in dovecot 1:2.4.5+dfsg1-3
has caused the Debian Bug report #1148937,
regarding dovecot-core: Incomplete fix for CVE-2026-40017
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148937: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148937
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: dovecot-core
Version: 1:2.4.5+dfsg1-2
Severity: important
Tags: security
X-Debbugs-Cc: Debian Security Team <[email protected]>
Dear Maintainer,
AFAICT the upstream fix for CVE-2026-40017 [0] relies on a new keyed
xxh64 strmap format v2, but the v1 → v2 on-disk upgrade only happens
when `dovecot_storage_version` is set to 2.4.5 or later:
https://github.com/dovecot/core/commit/d34ac20f89bef60f91cd898e431018ee57061125#diff-961059ca1c2993805f95ac5427aefdfea627c13a2c3476855fd859888a522cf0
However /etc/dovecot/dovecot.conf from 1:2.4.5+dfsg1-2 contains the
following two lines
dovecot_config_version = 2.4.0
dovecot_storage_version = 2.4.0
so AFAICT existing installations keep using crc32 hashes and remain
affected by the denial of service issue. X-Debbugs-Cc'ing secteam as
heads up: for the backports to older suites it might make sense to lower
the version threshold. (Given 2.3 series lack the storage version check
logic I will unconditionally trigger the v1 → v2 on-disk upgrade for
Bookworm LTS, but need to wait for subsequent suites to add support for
the v2 format to avoid broken upgrade paths.)
Unfortunately dovecot doesn't allow overriding `dovecot_*_version` later
in `/etc/dovecot/conf.d/99-*.conf`. Please consider bumping *both*
`dovecot_config_version` and `dovecot_storage_version` to 2.4.5.
An argument for bumping the former too is to honor the current
`mail_attachment_detection_options` default value for maildir. With the
current value dovecot adds `$HasAttachment` or `$HasNoAttachment
keywords for maildir too, but doesn't bump the HIGHESTMODSEQ counter
resulting in split-brain issues for QRESYNC-capable synchronization
tools (possibly a dovecot bug, but the stock configuration is not
affected and given `dovecot_storage_version` needs to be bumped anyway
it probably makes sense to upgrade `dovecot_config_version` too).
Thanks for maintaining dovecot!
--
Guilhem.
[0] IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-40017-imap-thread-o-m3-cpu-dos-via-crc32-hash-collision-in-strmap-mail-index-strmap-c-hash2-c
[1]
https://doc.dovecot.org/2.4.5/core/summaries/settings.html#mail_attachment_detection_options
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: dovecot
Source-Version: 1:2.4.5+dfsg1-3
Done: Noah Meyerhans <[email protected]>
We believe that the bug you reported is fixed in the latest version of
dovecot, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Noah Meyerhans <[email protected]> (supplier of updated dovecot package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 26 Sep 2026 15:49:52 -0400
Source: dovecot
Architecture: source
Version: 1:2.4.5+dfsg1-3
Distribution: unstable
Urgency: medium
Maintainer: Dovecot Maintainers <[email protected]>
Changed-By: Noah Meyerhans <[email protected]>
Closes: 1148937
Changes:
dovecot (1:2.4.5+dfsg1-3) unstable; urgency=medium
.
* [ae76ae5] update default dovecot_config_version and dovecot_storage_version
(Closes: #1148937)
* autopkgtests: fix mariadb socket path
Checksums-Sha1:
9f96c6d3279f352a62d33249cc49a1d17ad12bb2 4184 dovecot_2.4.5+dfsg1-3.dsc
0b98350be1b086dfd78feed15f069d35a50c65bd 91524
dovecot_2.4.5+dfsg1-3.debian.tar.xz
0a4ee4c5282641f347ece378228b2e59753c4beb 8318
dovecot_2.4.5+dfsg1-3_source.buildinfo
Checksums-Sha256:
e1b88e66f1bc30cc46b97159b4ba5b430d0de1136960f76d7af52de939e42c4b 4184
dovecot_2.4.5+dfsg1-3.dsc
703db3862bb61750d16a64b825390e7177828883fb1aabd5351cbe0efa516dff 91524
dovecot_2.4.5+dfsg1-3.debian.tar.xz
91ff86085655b0f13cde515c95b55dc28ea13105a9b9792eaa55d6ae291cd0e4 8318
dovecot_2.4.5+dfsg1-3_source.buildinfo
Files:
bc4d6cfa7c67928d828498a4619bc7d0 4184 mail optional dovecot_2.4.5+dfsg1-3.dsc
8944921a8b332c8eaf4ff1ccb6f3e13d 91524 mail optional
dovecot_2.4.5+dfsg1-3.debian.tar.xz
0a0cd69b442dfb1784321f246dabc45c 8318 mail optional
dovecot_2.4.5+dfsg1-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE5G+E0xEKhJuZ7RJ34+c1IpshdTUFAmq4fToACgkQ4+c1Ipsh
dTUrOA/8CQEDVvF12/DWBmt7w8aMLVRZu5zne9FSNxUQXif5lYHg5Q6XbdCAmJCE
sF7EHUrEFzTiylSY+ORq61qGDLxvw/JIDCuBRhjqnnf4OTSUKYUvurJSjfweui6l
gDPRfFEI1XM8fkJ9THbW66MieI3ntP02JQHvYN//x6qFu/nCT+Y/4BUsZTQQZprq
SxQINV65zWH3fqOT0PmSECwf8FTeXpwqapyo1dF7r4huBlM3JcHVvAeicpaGvXAT
HeONDlj37krQ9Ijrq+IF6Au++QngWhu7GDIaXGhj3q9+Nd8CTB2vXGOulEn6lEil
bgblIeh7RF4roiTwRo7fj07iY7HA0lA3+ho1Ln9eb8/rDJVcDjehgjd84DS9A8xr
V+LvcEnHHdYEEdgJEJ2AOP2dTUvvuYbbCkmNo7qJoFzc9M054Lt/IMeV/9PrjrnJ
ykE/2lrSKwxnXzUXU4hXh0PXT6ZV5B4y+JQQJ2CD/oGrg4t/VxaBPRsgc9BXdbiP
4soF6cE5Y/24zUMt0Xz9XCy+weZWMT7HpERTPF4p2QjwkjX8ZBapNA+86HWcaSKT
zqViMW3Ex51TMZ/MmOYTVDolTuAHjoIFFeSRKJDfmp0SyNpTmIfPUjcS07+S+6GM
cQKtcSHdZS3wv+8qxaO+OfZ/RGq40rK4bDrZ7sBMDi6qhMsW9to=
=UXkG
-----END PGP SIGNATURE-----
pgprzNwii5eMt.pgp
Description: PGP signature
--- End Message ---
