dovecot vulnerabilities
CVEs whose affected-version data names the dovecot package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-42006Medium· 4.3An attacker can cause uncontrolled memory usage with excessive bracing over IMAP
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for clo…
CVE-2026-27851High· 7.4When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authent…
CVE-2025-59032High· 7.5ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the ser…
CVE-2025-59031Medium· 4.3Dovecot has provided a script to use for attachment to text conversion
Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subs…
CVE-2025-59028Medium· 5.3When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail
When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install…