RHSA-2026:98587: Important: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/dovecotto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecot-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecot-debugsourceto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecot-mysqlto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecot-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecot-pgsqlto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecot-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecot-pigeonholeto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecot-pigeonhole-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecotto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa - Upgrade
Upgrade
redhat/dovecot-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa - Upgrade
Upgrade
redhat/dovecot-debugsourceto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa - Upgrade
Upgrade
redhat/dovecot-mysqlto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa - Upgrade
Upgrade
redhat/dovecot-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa - Upgrade
Upgrade
redhat/dovecot-pgsqlto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa - Upgrade
Upgrade
redhat/dovecot-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa - Upgrade
Upgrade
redhat/dovecot-pigeonholeto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa - Upgrade
Upgrade
redhat/dovecot-pigeonhole-debuginfoto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa - Upgrade
Upgrade
redhat/dovecot-develto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3 - Upgrade
Upgrade
redhat/dovecot-develto a version that resolves this vulnerability.Fixed in 2.3.21-22.el10_3.aa
Event History
Frequently Asked Questions
Which enabled services and features are most relevant to exposure?
IMAP deployments are relevant to the excessive-parameter ID-command denial of service. ManageSieve is implicated in truncated quoted-argument and login-process denial-of-service issues, while Sieve configurations using editheader are implicated in the use-after-free that can lead to arbitrary code execution.
When does the authentication bypass matter?
The authentication bypass is specifically associated with incorrect OAuth2 token validation. Deployments that do not use OAuth2 authentication are not identified by the advisory as exposed to that particular issue.
Are database-backed Dovecot deployments affected by distinct issues?
Yes. The advisory identifies a MySQL multi-byte escaping issue, and the affected software list includes the dovecot-mysql and dovecot-pgsql packages. The MySQL-specific issue is relevant to installations using the MySQL driver.
Can this information determine whether an installed system is already patched?
No. The provided advisory data lists affected packages but does not include fixed package versions, so patch status cannot be determined from this information alone.