RHSA-2026:98477: Important: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/dovecotto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecot-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecot-debugsourceto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecot-mysqlto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecot-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecot-pgsqlto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecot-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecot-pigeonholeto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecot-pigeonhole-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecotto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa - Upgrade
Upgrade
redhat/dovecot-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa - Upgrade
Upgrade
redhat/dovecot-debugsourceto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa - Upgrade
Upgrade
redhat/dovecot-mysqlto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa - Upgrade
Upgrade
redhat/dovecot-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa - Upgrade
Upgrade
redhat/dovecot-pgsqlto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa - Upgrade
Upgrade
redhat/dovecot-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa - Upgrade
Upgrade
redhat/dovecot-pigeonholeto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa - Upgrade
Upgrade
redhat/dovecot-pigeonhole-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa - Upgrade
Upgrade
redhat/dovecot-develto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9 - Upgrade
Upgrade
redhat/dovecot-develto a version that resolves this vulnerability.Fixed in 2.3.16-21.el9_9.aa
Event History
Frequently Asked Questions
Which installed packages are covered by this advisory?
The listed packages are redhat/dovecot, redhat/dovecot-debuginfo, redhat/dovecot-debugsource, redhat/dovecot-mysql, redhat/dovecot-mysql-debuginfo, redhat/dovecot-pgsql, redhat/dovecot-pgsql-debuginfo, and redhat/dovecot-pigeonhole.
Are the reported issues limited to denial of service?
No. The advisory also identifies an authentication bypass involving OAuth2 token validation, arbitrary code execution through a Sieve editheader use-after-free, and incorrect MySQL multi-byte escaping.
Which enabled features are specifically named in the reported attack paths?
The advisory names IMAP ID handling, OAuth2 token validation, ManageSieve argument and login processing, Sieve editheader functionality, MySQL escaping, crafted email-header handling, and connection-limit handling. Systems using these capabilities should prioritize applying the update.
Does the advisory say whether a default Dovecot configuration is affected or provide temporary mitigations?
No. The provided advisory data does not state whether default configurations are vulnerable, describe exploit prerequisites beyond the named functionality, or provide mitigations for systems that cannot yet patch.