------------------------------------------------------------------------- Debian LTS Advisory DLA-4556-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin May 01, 2026 https://wiki.debian.org/LTS -------------------------------------------------------------------------
Package : dovecot
Version : 1:2.3.13+dfsg1-2+deb11u3
CVE ID : CVE-2025-59031 CVE-2025-59032 CVE-2026-0394 CVE-2026-27855
CVE-2026-27856 CVE-2026-27857 CVE-2026-27858 CVE-2026-27859
Multiple vulnerabilities were discovered in dovecot, a POP3/IMAP server,
which could lead to Denial of Service, information leak, path traversal,
authentication bypass, replay attacks or timing side channel attacks.
CVE-2025-59031
The decode2text.sh example script, which was installed into
dovecot-core/examples, was found handle zip-style attachment in an
unsafe manner. In particular, OOXML extraction may follow symlinks
and read unintended files during indexing. The script is no longer
installed.
CVE-2025-59032
It was found that the ManageSieve AUTHENTICATE command crashes the
ManageSieve service when using literal as SASL initial response,
leading to Denial of Service.
CVE-2026-0394
A pass traversal vulnerability was discovered in the passwd-file
passdb/userdb when dovecot has been configured to use per-domain
passwd files, allowing inadvertently reading /etc/passwd in some
situations. If this file contains passwords, it can be used to
authenticate wrongly, or if this is userdb, it can incorrectly make
system users appear valid users.
CVE-2026-27855
The OTP authentication driver was found to be vulnerable to replay
attack if auth cache is enabled the and username is altered in
passdb. An attacker able to observe an OTP exchange is therefore
able to impersonate the user.
CVE-2026-27856
Doveadm credentials were not checked using timing-safe checking
functions. An attacker can exploit this issue to discover configured
credentials, leading into full access to the affected component.
CVE-2026-27857
It was discovered that sending excessive parenthesis caused the
imap-login process to use excessive memory, leading to Denial of
Service.
CVE-2026-27858
It was discovered that the managesieve-login process could allocate
large amount of memory during authentication via specifically crafted
message, leading to Denial of Service.
CVE-2026-27859
It was discovered that excessive RFC 2231 MIME parameters in email
would cause excessive CPU usage, which could lead to Denial of
Service. Dovecot now limits the number of parameters to process.
For Debian 11 bullseye, these problems have been fixed in version
1:2.3.13+dfsg1-2+deb11u3.
We recommend that you upgrade your dovecot packages.
For the detailed security status of dovecot please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/dovecot
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
signature.asc
Description: PGP signature
