CVE-2026-40018: SQL Injection

Published Aug 28, 2026

Updated

None None None No publicly available exploits are known.

Affected Software

4 affected componentsFixes available

debian/dovecot<1:2.3.19.1+dfsg1-2.1+deb12u7

1:2.3.19.1+dfsg1-2.1+deb12u7

debian/dovecot<1:2.4.1+dfsg1-6+deb13u7

1:2.4.1+dfsg1-6+deb13u7

debian/dovecot<1:2.4.5+dfsg1-1

1:2.4.5+dfsg1-1

debian/dovecot<=1:2.3.19.1+dfsg1-2.1+deb12u6, <=1:2.4.1+dfsg1-6+deb13u6

1:2.3.19.1+dfsg1-2.1+deb12u71:2.4.1+dfsg1-6+deb13u71:2.4.5+dfsg1-4

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/dovecot to a version that resolves this vulnerability.
Fixed in 1:2.3.19.1+dfsg1-2.1+deb12u7
Upgrade
Upgrade debian/dovecot to a version that resolves this vulnerability.
Fixed in 1:2.4.1+dfsg1-6+deb13u7
Upgrade
Upgrade debian/dovecot to a version that resolves this vulnerability.
Fixed in 1:2.4.5+dfsg1-1
Upgrade
Upgrade debian/dovecot to a version that resolves this vulnerability.
Fixed in 1:2.3.19.1+dfsg1-2.1+deb12u7Fixed in 1:2.4.1+dfsg1-6+deb13u7Fixed in 1:2.4.5+dfsg1-4

Aug 28, 2026

CVE Published

via MITRE·10:12 AM

Data Sourced

via MITRE·10:12 AM

DescriptionSeverityWeakness

Data Sourced

via Red Hat·11:24 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·12:16 PM

DescriptionSeverityAffected Software

This vulnerability appears in the following advisories.

Found alongside the following vulnerabilities.