RLSA-2026:98587: Important: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)
dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)
dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)
dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)
dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)
dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)
dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)
dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/dovecot-pigeonhole-debuginfoto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3 - Upgrade
Upgrade
rocky-linux/dovecot-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3 - Upgrade
Upgrade
rocky-linux/dovecot-pgsqlto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3 - Upgrade
Upgrade
rocky-linux/dovecot-mysqlto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3 - Upgrade
Upgrade
rocky-linux/dovecotto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3 - Upgrade
Upgrade
rocky-linux/dovecot-pigeonholeto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3 - Upgrade
Upgrade
rocky-linux/dovecot-debugsourceto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3 - Upgrade
Upgrade
rocky-linux/dovecot-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3 - Upgrade
Upgrade
rocky-linux/dovecot-develto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3 - Upgrade
Upgrade
rocky-linux/dovecot-debuginfoto a version that resolves this vulnerability.Fixed in 1:2.3.21-22.el10_3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which installed components are covered by this update?
The advisory covers Rocky Linux dovecot, dovecot-pigeonhole, dovecot-mysql, and dovecot-pgsql packages, along with their listed debuginfo and debugsource packages. Systems using SQL-backed authentication or Sieve functionality should account for the corresponding subpackages.
What attack paths are identified in the fixes?
The listed issues include malformed or excessive IMAP ID parameters, crafted email headers, ManageSieve arguments and login handling, connection-limit exhaustion, OAuth2 token validation, MySQL multi-byte escaping, and Sieve editheader processing. Several are denial-of-service issues; the Sieve editheader issue is identified as arbitrary code execution.
Does this advisory include an authentication-related risk?
Yes. One listed issue is an authentication bypass caused by incorrect OAuth2 token validation. Environments using OAuth2 authentication are therefore relevant to that specific issue.