ELA-1878-1 dovecot security update

Package	dovecot
Version	1:2.3.4.1-5+deb10u10 (buster), 1:2.3.13+dfsg1-2+deb11u5 (bullseye)
Related CVEs	CVE-2026-27852 CVE-2026-33263 CVE-2026-33604 CVE-2026-33605 CVE-2026-33606 CVE-2026-33607 CVE-2026-40013 CVE-2026-40014 CVE-2026-40015 CVE-2026-40017 CVE-2026-40018 CVE-2026-40203 CVE-2026-40204 CVE-2026-40205 CVE-2026-42007 CVE-2026-42008 CVE-2026-42391 CVE-2026-42393 CVE-2026-42394 CVE-2026-42395 CVE-2026-52687 CVE-2026-73208 CVE-2026-73209

Multiple vulnerabilities were discovered in dovecot, a POP3/IMAP server, which could result in denial of service, SMTP smuggling, information disclosure, SQL injection, remote code execution, bypass of ACL restrictions, or account impersonation.

CVE-2026-27852

An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed.

CVE-2026-33263

When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.

CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands.

CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.

CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync(1) with the stream protocol, for example during a migration.

CVE-2026-33607

An authenticated attacker can use a crafted IMAP LIST command to cause denial of service via excessive CPU usage. This is is mitigated via bounding backtracking to 20000; match_sub() returns IMAP_MATCH_NO when exceding that limit.

CVE-2026-40013

An authenticated attacker can submit a Sieve script containing a very large numeric literal, resulting in an out-of-bounds write when the ManageSieve service compiles the script.

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the victim’s IMAP THREAD command consume CPU disproportionate to the size of the message, resulting in denial of service.

CVE-2026-40015

An authenticated attacker can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process, resulting in denial of service.

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message, resulting in denial of service.

The fix introduces a new keyed xxh64 strmap on-disk format v2. strmap files using the old format are automatically upgraded, so they cannot be read by an older or unfixed dovecot version.

CVE-2026-40018

An unauthenticated attacker can perform SQL injection via multi-byte escaping.

CVE-2026-40203

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox.

An attacker that can send mail to a user and can also observe the sizes of that user’s IMAP traffic can confirm whether the body of a small message matches a guessed text. Recovery of arbitrary unknown content was not demonstrated, but the attack can disclose whether a secret-like message body matches a candidate.

This CRIME-style cross-command compression oracle attack is now mitigated by resetting the DEFLATE compression dictionary via Z_FULL_FLUSH after each tagged response line. A side-effect is that total traffic across a session might not be compressed as efficiently as before the fix.

CVE-2026-40204

An authenticated attacker can bypass ACLs bypass via lda_mailbox_autocreate().

CVE-2026-40205

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them.

This issue does not affect the dovecot version found in buster.

CVE-2026-42007

An authenticated attacker can use a Sieve script with the “editheader” extension from RFC 5293 to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail, which may result in arbitrary code execution.

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot’s own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can therefore authenticate as any user without knowing that user’s password.

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately, resulting in denial of service.

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret to any attacker able to measure response timing accurately.

CVE-2026-42394

Pigeonhole’s file storage follows any symlink encountered while resolving a script path, including symlinks in personal (user-writable) storage whose target lay outside the storage directory, thereby allowing arbitrary file disclosure via symlink traversal.

Symlinks escaping personal storage directory are no longer followed in this update.

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt, resulting in denial of service.

CVE-2026-52681

Sieve CPU resource usage is tracked in the compiled script, which allows an unauthenticated attacker to trivially reset the accounting by repeatedly changing the active script. Futhermore compiled script files are not removed when a script is deleted or renamed, resulting in on-disk clutter and possibly excessive disk usage.

The cumulative CPU tracking is now tracked in a per-user “sieve-rusage” file rather than in the binary header header of each compiled Sieve script.

CVE-2026-52687

An authenticated attacker can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections, resulting in denial of service.

The IMAP COMPRESS is now restricted to DEFLATE only in compliance with RFC 4978.

CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do.

This issue does not affect the dovecot version found in buster.

CVE-2026-73209

An authenticated attacker can send crafted compressed data that causes the affected process to exhaust its stack and crash, resulting in denial of service.

For Debian 10 buster, these problems have been fixed in version 1:2.3.4.1-5+deb10u10.

For Debian 11 bullseye, these problems have been fixed in version 1:2.3.13+dfsg1-2+deb11u5.

We recommend that you upgrade your dovecot packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.