This advisory covers three denial of service vulnerabilities in Dovecot: CVE-2025-59032 involves ManageSieve and a crafted SASL initial response in the AUTHENTICATE command; CVE-2026-27858 involves denial of service via a crafted message before authentication; and CVE-2026-27857 involves denial of service via a specially crafted NOOP command. Red Hat has issued an important security update for Red Hat Enterprise Linux 8 to address these issues. The advisory references fixes in dovecot version 2.3.16-7.el8_10 packages across multiple architectures. No CVSS scores are provided in the advisory, and no known exploits in the wild are reported.

Successful exploitation of these vulnerabilities could result in denial of service conditions against the Dovecot service, potentially disrupting email access for users. There is no indication of privilege escalation, data disclosure, or remote code execution impacts. The vulnerabilities affect the ManageSieve component and core IMAP/POP3 commands before authentication.

Red Hat has released updated dovecot packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update described in Red Hat Advisory RHSA-2026:13830 to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No other mitigation actions are indicated or required.