| CVE-2026-42006 |
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP
|
4.3
Medium
|
May 12, 2026 |
| CVE-2026-40016 |
Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time…
|
5.3
Medium
|
May 12, 2026 |
| CVE-2026-33603 |
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding
|
6.8
Medium
|
May 12, 2026 |
| CVE-2026-27851 |
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted…
|
7.4
High
|
May 12, 2026 |
| CVE-2026-27859 |
A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU
|
5.3
Medium
|
Mar 27, 2026 |
| CVE-2026-27860 |
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication
|
3.7
Low
|
Mar 27, 2026 |
| CVE-2026-27858 |
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large…
|
7.5
High
|
Mar 27, 2026 |
| CVE-2026-27857 |
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage
|
4.3
Medium
|
Mar 27, 2026 |
| CVE-2026-27856 |
Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack
|
7.4
High
|
Mar 27, 2026 |
| CVE-2026-27855 |
Dovecot OTP authentication is vulnerable to replay attack under specific conditions
|
6.8
Medium
|
Mar 27, 2026 |
| CVE-2026-24031 |
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin
|
7.7
High
|
Mar 27, 2026 |
| CVE-2026-0394 |
When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or…
|
5.3
Medium
|
Mar 27, 2026 |
| CVE-2025-59032 |
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response
|
7.5
High
|
Mar 27, 2026 |
| CVE-2025-59028 |
When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active…
|
5.3
Medium
|
Mar 27, 2026 |
| CVE-2025-59031 |
Dovecot has provided a script to use for attachment to text conversion
|
4.3
Medium
|
Mar 27, 2026 |
| CVE-2025-30189 |
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong…
|
7.4
High
|
Oct 31, 2025 |
| CVE-2024-23185 |
Very large headers can cause resource exhaustion when parsing message
|
7.5
High
|
Sep 10, 2024 |
| CVE-2024-23184 |
Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive
|
5.0
Medium
|
Sep 10, 2024 |
| CVE-2024-25584 |
Dovecot accepts dot LF DOT LF symbol as end of DATA command
|
5.3
Medium
|
Sep 6, 2024 |