[ALSA-2026:80825] Important: dovecot security update
Type:
security
Severity:
important
Release date:
2026-10-13
Description:
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 dovecot-mysql-2.3.16-18.el9_8.8.aarch64.rpm 19321936d7224e200afee344a801b8d753f6025cd6705fbbb6c485adb2ac970a
aarch64 dovecot-pgsql-2.3.16-18.el9_8.8.aarch64.rpm 36c3535385927d846efd0f38011e10542fb0cb5831a48f0b12aa1a98565450cf
aarch64 dovecot-devel-2.3.16-18.el9_8.8.aarch64.rpm 6eed6e662625bc1e1c55b263e09926127153fde4dadff0cbd1f18d390e663f13
aarch64 dovecot-pigeonhole-2.3.16-18.el9_8.8.aarch64.rpm a3977d9ec2a9ada1d897b63ce00f5b5399da82ba19179b6ff8a3ec5fa628ad52
aarch64 dovecot-2.3.16-18.el9_8.8.aarch64.rpm ab8480b4cb1e6bd545e4732cf5efdef4039fa135b95e608cfecb73ae185ebdad
i686 dovecot-devel-2.3.16-18.el9_8.8.i686.rpm 2b4ef5c524207d9e137db95b3eaa9c8b88dedce0062e35b0299347aa1978a743
i686 dovecot-2.3.16-18.el9_8.8.i686.rpm b5b9d4bc04c6f1bfc80196a416c41237c9c365513369c1fa0197e45a5e714712
ppc64le dovecot-mysql-2.3.16-18.el9_8.8.ppc64le.rpm 156778dfc9de83c6201f7217e3c9e87053e1bc9fda30b1aa20e5233a93362f87
ppc64le dovecot-2.3.16-18.el9_8.8.ppc64le.rpm 5e444b9038b070848dff44d73558188b9b5e00c41506f22c48a40b658c738b17
ppc64le dovecot-pigeonhole-2.3.16-18.el9_8.8.ppc64le.rpm 7ffa683b69ed76dc73a32f2d3f302a3c23a535f8ff90899da9683ca5c5515816
ppc64le dovecot-devel-2.3.16-18.el9_8.8.ppc64le.rpm c5649610f830c58869dced9e1964ac21d7619d6dad5a4489e082fbae7ce868a5
ppc64le dovecot-pgsql-2.3.16-18.el9_8.8.ppc64le.rpm e92ab7e3dcd4f8e279c7a427607be6229cc53931093bf96477fbe4686fdada01
s390x dovecot-devel-2.3.16-18.el9_8.8.s390x.rpm 5c552a702f80f6b89b167038ea87b916ffc236891bfa1635f976006312cd7d26
s390x dovecot-pgsql-2.3.16-18.el9_8.8.s390x.rpm 7d79fa7d3eebea9bc734d3875f0ea1cb727cbf81559edeb6ddf43a7e71ed7bad
s390x dovecot-2.3.16-18.el9_8.8.s390x.rpm 83c5825d82bddc0b1d723b9a6227b885cd1c3cb9431af49fd0a12946204b1770
s390x dovecot-pigeonhole-2.3.16-18.el9_8.8.s390x.rpm af8f869fef31ca30d6003306fa11f430dcc6e20b1e29f1a8265819061e0b04bd
s390x dovecot-mysql-2.3.16-18.el9_8.8.s390x.rpm cfe1a6b021d3a62e8d791bb147147688f81ce5eed7a834575968d43eb3ff1bca
x86_64 dovecot-pigeonhole-2.3.16-18.el9_8.8.x86_64.rpm 2c7e5d209008c6c3915531eea644221cf02fa10224bd1d6e22630a27696bd988
x86_64 dovecot-pgsql-2.3.16-18.el9_8.8.x86_64.rpm 62ddf4c8e23b5847f6b5b2760aa55f0912223fdbffd19eeb63953c5637f4c1b6
x86_64 dovecot-2.3.16-18.el9_8.8.x86_64.rpm 793304dd7c691d809485bed35aa87dcc7f842eceb02ec2b33d1ef958cbf84d00
x86_64 dovecot-mysql-2.3.16-18.el9_8.8.x86_64.rpm 83581cbbef58aa78ef66a9bf74505cba8c2095a4fb40fa37eddc0fc92e9ba394
x86_64 dovecot-devel-2.3.16-18.el9_8.8.x86_64.rpm ea1a14280768eed28618883e7d6f91c544bacce521554aeafc3d7c7d486245f9
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.