Your message dated Fri, 02 Oct 2026 15:17:06 +0000
with message-id <[email protected]>
and subject line Bug#1144639: fixed in dovecot 1:2.4.1+dfsg1-6+deb13u7
has caused the Debian Bug report #1144639,
regarding dovecot-imapd: repeated crashes due to assertion failure in
istream-header-filter.c
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144639: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144639
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: dovecot-imapd
Version: 1:2.4.1+dfsg1-6+deb13u6
Severity: normal
I was experimenting with using Vivaldi Mail, and dovecot-imapd started
crashing repeatedly when Vivaldi was trying to sync and index my (huge)
mailbox.
Messages logged by Dovecot:
2026-08-14 10:26:43 imap(ian)<466672><Dy4ka/5Y9r1SRXa8>: Panic: file
istream-header-filter.c: line 665 (i_stream_header_filter_snapshot_free):
assertion failed: (snapshot->mstream->snapshot_pending)
2026-08-14 10:26:43 imap(ian)<466672><Dy4ka/5Y9r1SRXa8>: Error: Raw backtrace:
#1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] ->
#3 i_panic[0x7fe47ca655e6] -> #4 [unw_get_proc_name() failed: -10] -> #5
i_stream_snapshot_free[0x7fe47cb45c00] -> #6 i_stream_unref[0x7fe47cb45c70] ->
#7 [unw_get_proc_name() failed: -10] -> #8 [unw_get_proc_name() failed: -10] ->
#9 index_mail_get_special[0x7fe47cd494c0] -> #10
mail_get_special[0x7fe47ccc2700] -> #11 [unw_get_proc_name() failed: -10] ->
#12 [unw_get_proc_name() failed: -10] -> #13 imap_fetch_more[0x561b58c5cf80] ->
#14 cmd_fetch[0x561b58c50e40] -> #15 command_exec[0x561b58c5a080] -> #16
[unw_get_proc_name() failed: -10] -> #17 [unw_get_proc_name() failed: -10] ->
#18 [unw_get_proc_name() failed: -10] -> #19
client_handle_input[0x561b58c60990] -> #20 client_input[0x561b58c60ed0] -> #21
io_loop_call_io[0x7fe47cb51750] -> #22
io_loop_handler_run_internal[0x7fe47cb534f0] -> #23
io_loop_handler_run[0x7fe47cb53680] -> #24 io_loop_run[0x7fe47cb53860] -> #25
master_service_run[0x7fe47caa6330] -> #26 main[0x561b58c4b880] -> #27
[unw_get_proc_name() failed: -10] -> #28 __libc_start_main[0x7fe47c835ce0] ->
#29 _start[0x561b58c4bf30]
A friend kindly noted that upstream commit
https://github.com/dovecot/core/commit/3ff6022baa757583faf579251fc40 may
fix this problem. I applied it to 2.4.1+dfsg1-6+deb13u6 and this did
indeed fix the problem.
-- Package-specific info:
dovecot configuration
---------------------
# 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf
# Pigeonhole version 2.4.1-4 (0a86619f)
# OS: Linux 6.12.101+deb13-amd64 x86_64 Debian 13.6
# Hostname: swiss.chard.org
# 4 default setting changes since version 2.4.0
dovecot_config_version = 2.4.0
auth_username_format = %{user|username|lower}
auth_verbose = yes
dovecot_storage_version = 2.4.0
fts_autoindex = yes
fts_autoindex_max_recent_msgs = 999
fts_search_add_missing = yes
log_path = /var/log/dovecot
log_timestamp = "%Y-%m-%d %H:%M:%S "
mail_driver = mbox
mail_home = /home/%{user | username}
mail_inbox_path = /var/mail/%{user}
mail_path = %{home}/mail
mail_privileged_group = mail
protocols {
imap = yes
}
ssl = required
ssl_cipher_list =
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
passdb pam {
driver = pam
}
userdb passwd {
driver = passwd
}
namespace inbox {
inbox = yes
mailbox Drafts {
special_use = "\\Drafts"
}
mailbox Junk {
special_use = "\\Junk"
}
mailbox Trash {
special_use = "\\Trash"
}
mailbox Sent {
special_use = "\\Sent"
}
mailbox "Sent Messages" {
special_use = "\\Sent"
}
}
service imap-login {
inet_listener imap {
port = 0
}
inet_listener imaps {
}
}
service auth {
unix_listener auth-userdb {
}
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0660
user = postfix
}
}
service auth-worker {
}
service stats {
fifo_listener stats-mail {
mode = 0666
}
unix_listener stats {
mode = 0666
}
}
ssl_server {
cert_file = [redacted]
dh_file = /etc/dovecot/dh.pem
key_file = [redacted]
prefer_ciphers = client
}
protocol imap {
mail_max_userip_connections = 100
}
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.101+deb13-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: SELinux: enabled - Mode: Permissive - Policy name: default
Versions of packages dovecot-imapd depends on:
ii dovecot-core 1:2.4.1+dfsg1-6+deb13u6
ii libbz2-1.0 1.0.8-6
ii libc6 2.41-12+deb13u3
ii liblz4-1 1.10.0-4
ii libzstd1 1.5.7+dfsg-1
ii ucf 3.0052
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1
dovecot-imapd recommends no packages.
Versions of packages dovecot-imapd suggests:
pn ufw <none>
Versions of packages dovecot-imapd is related to:
ii dovecot-core [dovecot-common] 1:2.4.1+dfsg1-6+deb13u6
pn dovecot-dev <none>
pn dovecot-gssapi <none>
ii dovecot-imapd 1:2.4.1+dfsg1-6+deb13u6
pn dovecot-ldap <none>
pn dovecot-lmtpd <none>
pn dovecot-managesieved <none>
pn dovecot-mysql <none>
pn dovecot-pgsql <none>
pn dovecot-pop3d <none>
ii dovecot-sieve 1:2.4.1+dfsg1-6+deb13u6
pn dovecot-sqlite <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: dovecot
Source-Version: 1:2.4.1+dfsg1-6+deb13u7
Done: Noah Meyerhans <[email protected]>
We believe that the bug you reported is fixed in the latest version of
dovecot, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Noah Meyerhans <[email protected]> (supplier of updated dovecot package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 16 Sep 2026 15:06:35 -0400
Source: dovecot
Architecture: source
Version: 1:2.4.1+dfsg1-6+deb13u7
Distribution: trixie-security
Urgency: medium
Maintainer: Dovecot Maintainers <[email protected]>
Changed-By: Noah Meyerhans <[email protected]>
Closes: 1144639 1146018
Changes:
dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium
.
* Import upstream fixes for multiple security issues. (Closes: #1146018)
- CVE-2026-27852: DoS by sending mail with bad header
- CVE-2026-33263: submission-login: Panic when
mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8)
failed: Bad file descriptor
- CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare
Carriage Return
- CVE-2026-33605: managesieve-login: Pre-auth crash
- CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential
Backtracking — CPU Denial of Service
- CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole
ManageSieve CHECKSCRIPT/PUTSCRIPT
- CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted
References Header (index-thread-links.c)
- CVE-2026-40015: imap-hibernate can be crashed
- CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision
in strmap (mail-index-strmap.c / hash2.c)
- CVE-2026-40018: MySQL multi-byte escaping wrong
- CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl
restrictions
- CVE-2026-42007: Sieve editheader RCE
- CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command
- CVE-2026-42394: sieve: symlink traversal flaw could result in
arbitrary file disclosure
- CVE-2026-52681: Sieve resource usage tracking lost when active
script changes
- CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage
- CVE-2026-73209: imap-login crash: Self-recursion on zero-output
decompress chunks
- CVE-2026-33606: dsync: Mail content can cause dsync protocol
injection
- CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced
Email Body Matches Sender-Chosen Text
- CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows
nopassword injection via trusted proxy
- CVE-2026-42392: imap-urlauth leaks memory into user-visible error
messages
- CVE-2026-42393: doveadm_password or api key length can still be
leaked with timing comparisons
- CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes
- CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR
semantics in remote validation path
- CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for
missing scope claim
* lib-mail: istream-header-filter - Fix potential assert-crash
(Closes: #1144639)
* CI: Disable test-build-twice job, which is known to fail on trixie
Checksums-Sha1:
5d580e68fbf81eea11ab0d2382aef780ee8640e6 3992 dovecot_2.4.1+dfsg1-6+deb13u7.dsc
269572ee0e0af1ca6dfdf180142ecc28f462d945 202952
dovecot_2.4.1+dfsg1-6+deb13u7.debian.tar.xz
275e296f29f19114b8bc618d1115623daed3e559 7748
dovecot_2.4.1+dfsg1-6+deb13u7_source.buildinfo
Checksums-Sha256:
c69943573c24825eee761e23deaf0de4fbc7cc251e6c7564916dbe586cbeaa4d 3992
dovecot_2.4.1+dfsg1-6+deb13u7.dsc
e8831e6dbcbd17fb8485af9bc5c81b48cdb16fd89a8084561f672475236f556d 202952
dovecot_2.4.1+dfsg1-6+deb13u7.debian.tar.xz
46d4552c23225e205abc6eb8693352f53e3e2de6735a29d60fe1e90882275b20 7748
dovecot_2.4.1+dfsg1-6+deb13u7_source.buildinfo
Files:
81419335a1847c4d9370af6f43ea3631 3992 mail optional
dovecot_2.4.1+dfsg1-6+deb13u7.dsc
108e44d7bdd4896814eca4a0dc1e899f 202952 mail optional
dovecot_2.4.1+dfsg1-6+deb13u7.debian.tar.xz
929cbc0d5c7969f6167ea2bd5a76ba24 7748 mail optional
dovecot_2.4.1+dfsg1-6+deb13u7_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE5G+E0xEKhJuZ7RJ34+c1IpshdTUFAmq5GpkACgkQ4+c1Ipsh
dTXKtxAAu39fM8dWDUz+9LXojP/kj8KLzGtWIy4S0uBhzjT/ye+wcSSN631IRfXz
eckDwXRg3vGiT+IALuk5nl8MMSH5P+kO6xqJV6j4gQclUR5TkTYJUso9rYFmoCNH
njUfF+1fkcGSZeNs/7Blkh2ERPC3yHsxxZ645Nj6UYJDU+nRIkdx5sXGpEzvAW23
zl7WHyfC9tO354k6iCqxQm8mn20B05zF8ZXozObLSOKjU8JA1VnF5YLaKSUkkGIu
qS7DcWMJlniKoB1qUVJSPsIphMWoy3pXIWU+Z++pZmTYzg2HEPPuIoD8oF2c2HQA
bcjCH77mnmbHmTg4CIQU0XjDkolGKSg9bHseE/ehPw+u2q+6SwhgmS+QOLZhgifw
3jrEnkcl54rtrdTtpGLg6Q7GKTUizRVbO0pa5xHuNcdd9sYRjo7hd+n6rkPRs/g8
tyeEDVg/UqAWG8Tyiv08EFat8U3dSXX/fQi7OoNIVMDdCBmO1N9q63gRh8Dld6ZC
KdOn38PAltF5jQM+oMm57zZ39VZBrCDpNdoxdRCnLfMQjuu3bu1ufGyjvJxB80rP
iAOZRvc2pnTDn/J1Z+QDdZbSUPXkZ8TQEX0D5ArCK1g6vNlemv9K95tfeDRTr4Uh
DUMi2PllZ/PoaAo7xAnFYm8vkMSn0wEXPlTRvkIwwnZCE9OYIdo=
=tX12
-----END PGP SIGNATURE-----
pgpR3P2Kq2j9l.pgp
Description: PGP signature
--- End Message ---
