Source: dovecot Version: 1:2.4.4+dfsg1-2 Severity: grave Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for dovecot. CVE-2026-27852[0]: | An attacker that can send mail to a user can craft a message whose | headers contain a very large number of email addresses or MIME | parameters, which causes excessive memory usage when the message is | later parsed. The message is still delivered, but reading it over | IMAP can exhaust the memory limit of the process and terminate it, | causing denial of service for the affected user. Update to non- | vulnerable version. No publicly available exploits are known. CVE-2026-33263[1]: | When mail_max_userip_connections is set (default 10) and reached, | submission-login can crash with epoll() panic caused by file | descriptor handling issues. If running in high-security mode | (default for community releases), only the new submission connection | gets terminated. If running in high-performance mode (default for | Pro releases), all connections handled by the submission-login | process will be terminated. The crashes can cause failure for user | to send a message, or it can cause duplicate messages to be sent. If | TLS is not used (in the backend server processing the submission), | duplicate deliveries cannot happen, because the crash can only | happen at AUTH stage. Limit the number of connections handled by | single submission-login process. This has a performance impact | though. Update to non-vulnerable version. No publicly available | exploits are known. CVE-2026-33604[2]: | An attacker that can get Dovecot to relay a message, for example | through Sieve redirect or submission relay, can use a crafted line | ending in the message body to bypass the outbound protection that | prevents message content from being interpreted as SMTP commands. A | downstream mail server that hasn't yet fixed the SMTP smuggling | vulnerability can be tricked into treating part of the message body | as new SMTP commands, allowing injection of spoofed email. This is | the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. | Where you control the receiving mail servers, ensure they reject | bare carriage returns in message data. Update to non-vulnerable | version. No publicly available exploits are known. CVE-2026-33605[3]: | An unauthenticated attacker can crash the ManageSieve login process | by sending a small malformed command before authenticating. If | running in high-security mode (default for community releases), only | the attacker's own connection is terminated. If running in high- | performance mode (default for Pro releases), all connections handled | by the same managesieve-login process are terminated. Repeating the | attack can cause denial of service for Sieve script management. | Restrict network access to the ManageSieve service to trusted | clients. Update to non-vulnerable version. No publicly available | exploits are known. CVE-2026-33606[4]: | Mail content stored by a user can be crafted so that it is | interpreted as dsync protocol commands when an administrator later | runs dsync with the stream protocol, for example during a migration. | Injected commands can modify mailbox state on the destination during | migration or replication, including internal mailbox attributes that | a user should not be able to set directly. It can also cause dsync | errors. Avoid running dsync with the stream protocol on mailboxes | with untrusted content. Update to non-vulnerable version. No | publicly available exploits are known. CVE-2026-33607[5]: | An attacker that has valid credentials can use IMAP LIST command to | consume CPU. This can cause degradation or denial of service for | IMAP. Monitor system for abnormal CPU usage and kill the offending | process and lock account. Alternatively install fixed version. No | publicly available exploits are known. CVE-2026-40013[6]: | An attacker that has valid credentials can submit a Sieve script | containing an extreme numeric literal, which causes an out-of-bounds | write when the ManageSieve service compiles the script. This causes | memory corruption and an observed crash of the ManageSieve process, | resulting in denial of service for script management. This might be | able to be used for remote code execution. Disable the ManageSieve | service if users do not need remote Sieve script management. Update | to non-vulnerable version. No publicly available exploits are known. CVE-2026-40014[7]: | An attacker that can send mail to a user can craft a message header | that makes the IMAP THREAD command consume CPU disproportionate to | the size of the message. When a mail client issues a THREAD command | on the affected mailbox, this can cause degradation or denial of | service for IMAP. Monitor system for abnormal CPU usage, kill the | offending process and remove the offending message from the affected | mailbox. Update to non-vulnerable version. No publicly available | exploits are known. CVE-2026-40015[8]: | An attacker that has valid credentials can open many connections to | the imap-hibernate service and send invalid commands, which can | intermittently cause an out-of-bounds read and crash the process. | The crash interrupts hibernated IMAP sessions handled by the | affected process, which can cause degradation of service for IMAP. | Disable IMAP hibernation. Update to non-vulnerable version. No | publicly available exploits are known. CVE-2026-40017[9]: | An attacker that can send mail to a user can craft a message header | whose values are chosen to collide in an internal hash table, which | makes the IMAP THREAD command consume CPU disproportionate to the | size of the message. This is a separate issue from CVE-2026-40014 | and is not addressed by that fix. Whenever a mail client issues a | THREAD command on the affected mailbox, this can cause degradation | or denial of service for IMAP. Monitor system for abnormal CPU | usage, kill the offending process and remove the offending message | from the affected mailbox. Update to non-vulnerable version. No | publicly available exploits are known. CVE-2026-40018[10]: | None None None No publicly available exploits are known. CVE-2026-40019[11]: | An unauthenticated attacker can send a truncated quoted argument to | the ManageSieve login process, which makes it spin in an infinite | loop consuming CPU. This can cause degradation or denial of service | for Sieve script management, and repeated connections can consume | all available CPU on the server. Monitor system for abnormal CPU | usage and kill the offending process. Restrict network access to the | ManageSieve service to trusted clients. Update to non-vulnerable | version. No publicly available exploits are known. CVE-2026-40203[12]: | When IMAP compression is enabled, the same compression state is | reused across responses in a session, so response sizes depend on | both attacker-supplied mail and other mail in the same mailbox. An | attacker that can send mail to a user and can also observe the sizes | of that user's IMAP traffic can confirm whether the body of a small | message matches a guessed text. Recovery of arbitrary unknown | content was not demonstrated, but the attack can disclose whether a | secret-like message body matches a candidate. Disable IMAP | compression. Update to non-vulnerable version. No publicly available | exploits are known. CVE-2026-40204[13]: | None None None No publicly available exploits are known. CVE-2026-40205[14]: | An attacker that holds an OAuth2 token granting only part of the | required scopes can authenticate, because when more than one scope | is required in the configuration, the remote token validation paths | accept a token that carries only one of them, while the local token | validation path correctly requires all of them. The configured | authorization policy is not enforced, so a token that was granted | only part of the required permissions is accepted where it should | have been rejected. Use local token validation where tokens can be | validated locally. Update to non-vulnerable version. No publicly | available exploits are known. CVE-2026-42007[15]: | An attacker that has valid credentials can use a Sieve script with | the editheader extension to trigger a use-after-free in the mail | editing code, and to write memory contents beyond the intended | buffer into the delivered mail. This causes memory leak and | opportunity to do memory corruption during mail delivery, which can | crash the delivery process and may allow execution of arbitrary code | in the context of that process. Disable the Sieve editheader | extension. Update to non-vulnerable version. No publicly available | exploits are known. CVE-2026-42008[16]: | Forwarding information received from a host listed as a trusted | proxy is not kept separate from Dovecot's own authentication fields, | so a value sent by that host can be injected as an internal | authentication field. Any host permitted to act as a trusted proxy | can authenticate as any user without knowing that user's password. | This affects deployments whose password database honours a field | that permits authentication without a password. Deployments that do | not configure trusted proxies are not affected. Restrict the list of | trusted proxy networks to hosts that are fully under your control. | Update to non-vulnerable version. No publicly available exploits are | known. CVE-2026-42391[17]: | An unauthenticated attacker can send an IMAP ID command with a very | large number of parameters before logging in, which causes memory | and CPU usage to grow disproportionately. The login process can be | terminated by the out-of-memory handling, which also terminates all | other connections handled by the same process. This can cause | degradation or denial of service for IMAP logins. Limit the number | of connections handled by a single imap-login process. This has a | performance impact though. Update to non-vulnerable version. No | publicly available exploits are known. CVE-2026-42392[18]: | An attacker that has valid credentials can send an invalid IMAP | URLFETCH command, which causes uninitialized memory to be included | in the error response returned to the client. Process memory | contents can be disclosed to the client, which may include sensitive | data. Disable the IMAP URLAUTH functionality. Update to non- | vulnerable version. No publicly available exploits are known. CVE-2026-42393[19]: | The comparison used for the doveadm password and API key is not | fully timing safe and can reveal the length of the configured | secret. An attacker with access to the same network as the doveadm | service, able to make repeated requests and measure response timing | accurately, can learn the length of the secret, which reduces the | effort needed to guess it. The secret value itself is not disclosed. | Restrict network access to the doveadm service to trusted clients. | Update to non-vulnerable version. No publicly available exploits are | known. CVE-2026-42395[20]: | A host listed as a trusted proxy can send forwarding information | containing a NUL byte, which crashes the login process on the | following login attempt. The login process is terminated, which can | cause degradation or denial of service for logins. Deployments that | do not configure trusted proxies are not affected. Restrict the list | of trusted proxy networks to hosts that are fully under your | control. Update to non-vulnerable version. No publicly available | exploits are known. CVE-2026-52681[21]: | Sieve CPU resource usage is tracked in the compiled script, so an | attacker that has valid credentials can reset the accounting by | repeatedly changing the active script. Compiled script files are | also not removed when a script is deleted or renamed. The configured | Sieve CPU limit can be bypassed, allowing sustained CPU consumption, | and the leftover files increase disk consumption. Both can cause | degradation of service for mail delivery. Monitor system for | abnormal CPU usage and disk consumption. Update to non-vulnerable | version. No publicly available exploits are known. CVE-2026-52687[22]: | An attacker that has valid credentials can select a compression | algorithm for the IMAP connection whose decompression state requires | a large amount of memory, and open several such connections. The | memory limit of the process is reached with only a few connections, | terminating the process and all connections it handles, which can | cause degradation or denial of service for IMAP. Disable IMAP | compression. Alternatively limit the number of connections handled | by a single imap-login process, though this has a performance | impact. Update to non-vulnerable version. No publicly available | exploits are known. CVE-2026-73208[23]: | An attacker that holds a token intended for a different purpose can | authenticate, because when an OAuth2 token response does not contain | a scope claim, the audience claim is used in its place and checked | against the configured required scopes. These are different | concepts, and the audience claim does not describe what a token is | allowed to do. A token that grants no relevant permissions can be | accepted because its intended recipient value happens to match a | configured scope name, granting access that should have been denied. | It also hides an identity provider misconfiguration where scopes are | not being issued at all. Ensure the identity provider issues a scope | claim for all tokens used with Dovecot, and that configured scope | names do not match audience values. Update to non-vulnerable | version. No publicly available exploits are known. CVE-2026-73209[24]: | An attacker that has valid credentials can send crafted compressed | data that causes the affected process to exhaust its stack and | crash. The affected process is terminated, which can cause | degradation or denial of service for IMAP. Update to non-vulnerable | version. No publicly available exploits are known. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-27852 https://www.cve.org/CVERecord?id=CVE-2026-27852 [1] https://security-tracker.debian.org/tracker/CVE-2026-33263 https://www.cve.org/CVERecord?id=CVE-2026-33263 [2] https://security-tracker.debian.org/tracker/CVE-2026-33604 https://www.cve.org/CVERecord?id=CVE-2026-33604 [3] https://security-tracker.debian.org/tracker/CVE-2026-33605 https://www.cve.org/CVERecord?id=CVE-2026-33605 [4] https://security-tracker.debian.org/tracker/CVE-2026-33606 https://www.cve.org/CVERecord?id=CVE-2026-33606 [5] https://security-tracker.debian.org/tracker/CVE-2026-33607 https://www.cve.org/CVERecord?id=CVE-2026-33607 [6] https://security-tracker.debian.org/tracker/CVE-2026-40013 https://www.cve.org/CVERecord?id=CVE-2026-40013 [7] https://security-tracker.debian.org/tracker/CVE-2026-40014 https://www.cve.org/CVERecord?id=CVE-2026-40014 [8] https://security-tracker.debian.org/tracker/CVE-2026-40015 https://www.cve.org/CVERecord?id=CVE-2026-40015 [9] https://security-tracker.debian.org/tracker/CVE-2026-40017 https://www.cve.org/CVERecord?id=CVE-2026-40017 [10] https://security-tracker.debian.org/tracker/CVE-2026-40018 https://www.cve.org/CVERecord?id=CVE-2026-40018 [11] https://security-tracker.debian.org/tracker/CVE-2026-40019 https://www.cve.org/CVERecord?id=CVE-2026-40019 [12] https://security-tracker.debian.org/tracker/CVE-2026-40203 https://www.cve.org/CVERecord?id=CVE-2026-40203 [13] https://security-tracker.debian.org/tracker/CVE-2026-40204 https://www.cve.org/CVERecord?id=CVE-2026-40204 [14] https://security-tracker.debian.org/tracker/CVE-2026-40205 https://www.cve.org/CVERecord?id=CVE-2026-40205 [15] https://security-tracker.debian.org/tracker/CVE-2026-42007 https://www.cve.org/CVERecord?id=CVE-2026-42007 [16] https://security-tracker.debian.org/tracker/CVE-2026-42008 https://www.cve.org/CVERecord?id=CVE-2026-42008 [17] https://security-tracker.debian.org/tracker/CVE-2026-42391 https://www.cve.org/CVERecord?id=CVE-2026-42391 [18] https://security-tracker.debian.org/tracker/CVE-2026-42392 https://www.cve.org/CVERecord?id=CVE-2026-42392 [19] https://security-tracker.debian.org/tracker/CVE-2026-42393 https://www.cve.org/CVERecord?id=CVE-2026-42393 [20] https://security-tracker.debian.org/tracker/CVE-2026-42395 https://www.cve.org/CVERecord?id=CVE-2026-42395 [21] https://security-tracker.debian.org/tracker/CVE-2026-52681 https://www.cve.org/CVERecord?id=CVE-2026-52681 [22] https://security-tracker.debian.org/tracker/CVE-2026-52687 https://www.cve.org/CVERecord?id=CVE-2026-52687 [23] https://security-tracker.debian.org/tracker/CVE-2026-73208 https://www.cve.org/CVERecord?id=CVE-2026-73208 [24] https://security-tracker.debian.org/tracker/CVE-2026-73209 https://www.cve.org/CVERecord?id=CVE-2026-73209 Regards, Salvatore
