Red Hat Security Advisory: dovecot security update

This Red Hat security advisory addresses multiple vulnerabilities in Dovecot versions used in Red Hat Enterprise Linux 8, including denial of service via IMAP ID command with excessive parameters (CVE-2026-42391), authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208), denial of service via crafted email headers (CVE-2026-27852), denial of service via truncated quoted argument in ManageSieve (CVE-2026-40019), denial of service and potential message duplication via connection limit exhaustion (CVE-2026-33263), denial of service in ManageSieve login process (CVE-2026-33605), arbitrary code execution via sieve editheader use-after-free (CVE-2026-42007), and MySQL multi-byte escaping issues (CVE-2026-40018). The advisory provides fixes in updated Dovecot packages for multiple architectures and variants of Red Hat Enterprise Linux 8. The vulnerabilities affect core mail server components and could allow attackers to cause service disruption, bypass authentication, or execute arbitrary code remotely.

The vulnerabilities collectively allow for denial of service conditions, authentication bypass, and remote code execution in affected Dovecot versions. This could lead to service outages, unauthorized access, or full compromise of the mail server. The advisory rates the security impact as Important, with some issues classified as critical due to the potential for remote code execution. There are no known exploits in the wild at the time of publication.

Red Hat has released updated Dovecot packages (e.g., dovecot-2.3.16-16.el8_10) that address these vulnerabilities. Users should apply the official Red Hat update promptly to remediate the issues. Detailed update instructions are available in the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the vendor-provided patches.