| Package | dovecot |
|---|---|
| Version | 1:2.3.4.1-5+deb10u9 (buster) |
| Related CVEs | CVE-2025-59031 CVE-2025-59032 CVE-2026-0394 CVE-2026-27856 CVE-2026-27857 CVE-2026-27858 CVE-2026-27859 CVE-2026-33603 CVE-2026-40020 |
Multiple vulnerabilities were discovered in dovecot, a POP3/IMAP server, which could lead to Denial of Service, information leak, path traversal, authentication bypass or timing side channel attacks.
- CVE-2025-59031
-
The
decode2text.shexample script, which was installed into dovecot-core/examples, was found handle zip-style attachment in an unsafe manner. In particular, OOXML extraction may follow symlinks and read unintended files during indexing. The script is no longer installed. - CVE-2025-59032
-
It was found that the ManageSieve
AUTHENTICATEcommand crashes the ManageSieve service when using literal as SASL initial response, leading to Denial of Service. - CVE-2026-0394
-
A pass traversal vulnerability was discovered in the passwd-file passdb/userdb when dovecot has been configured to use per-domain passwd files, allowing inadvertently reading
/etc/passwdin some situations. If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can incorrectly make system users appear valid users. - CVE-2026-27856
-
Doveadm credentials were not checked using timing-safe checking functions. An attacker can exploit this issue to discover configured credentials, leading into full access to the affected component.
- CVE-2026-27857
-
It was discovered that sending excessive parenthesis caused the imap-login process to use excessive memory, leading to Denial of Service.
- CVE-2026-27858
-
It was discovered that the managesieve-login process could allocate large amount of memory during authentication via specifically crafted message, leading to Denial of Service.
- CVE-2026-27859
-
It was discovered that excessive RFC 2231 MIME parameters in email would cause excessive CPU usage, which could lead to Denial of Service. Dovecot now limits the number of parameters to process.
- CVE-2026-33603
-
An attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding and later eavesdrop communications between Dovecot and client as MITM proxy.
- CVE-2026-40020
-
An attacker can use the IMAP
SETACLcommand to inject the anyone permission to user’s dovecot-acl file even ifimap_acl_allow_anyone=no, thereby allowing folders to be spammed to all users. (The impact was limited to being able to spam folders to other users. No unexpected access is gained.)
For Debian 10 buster, these problems have been fixed in version 1:2.3.4.1-5+deb10u9.
We recommend that you upgrade your dovecot packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.