RLSA-2026:98477: Important: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)
dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)
dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)
dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)
dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)
dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)
dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)
dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/dovecotto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9 - Upgrade
Upgrade
rocky-linux/dovecot-debuginfoto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9 - Upgrade
Upgrade
rocky-linux/dovecot-debugsourceto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9 - Upgrade
Upgrade
rocky-linux/dovecot-develto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9 - Upgrade
Upgrade
rocky-linux/dovecot-mysqlto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9 - Upgrade
Upgrade
rocky-linux/dovecot-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9 - Upgrade
Upgrade
rocky-linux/dovecot-pgsqlto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9 - Upgrade
Upgrade
rocky-linux/dovecot-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9 - Upgrade
Upgrade
rocky-linux/dovecot-pigeonholeto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9 - Upgrade
Upgrade
rocky-linux/dovecot-pigeonhole-debuginfoto a version that resolves this vulnerability.Fixed in 1:2.3.16-21.el9_9
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize Rocky Linux systems with Dovecot packages installed, especially deployments using OAuth2 authentication, ManageSieve, Sieve editheader functionality, or the MySQL driver. The affected package set includes dovecot, dovecot-mysql, dovecot-pgsql, and their development, debug, and debuginfo packages.
What access does an attacker need according to the published severity vector?
The advisory is rated as network-accessible, low-complexity, requiring low privileges, and requiring no user interaction. Its vector also indicates changed scope, low confidentiality and integrity impact, and high availability impact.
What operational impacts should incident responders consider?
The listed issues include multiple denial-of-service conditions, an OAuth2 authentication bypass, potential message duplication through connection-limit exhaustion, incorrect MySQL multi-byte escaping, and arbitrary code execution involving Sieve editheader. Availability disruption is the highest-rated impact in the provided severity vector.
Can an administrator determine whether a default installation is affected from this advisory?
No default-configuration status is provided. The advisory does not state which Dovecot services, authentication methods, SQL drivers, or Sieve features are enabled by default.
How can administrators establish whether their installed packages contain the fixes?
The provided data identifies affected package names but does not include fixed package versions. Administrators need to compare their installed Rocky Linux Dovecot package versions with the updated packages associated with RLSA-2026:98477.