This advisory addresses three denial of service vulnerabilities in Dovecot affecting Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The vulnerabilities include: CVE-2025-59032, a denial of service via a crafted SASL initial response in the AUTHENTICATE command of ManageSieve; CVE-2026-27858, a denial of service via a crafted message before authentication; and CVE-2026-27857, a denial of service via a specially crafted NOOP command. Red Hat has released updated Dovecot packages (version 2.3.16-3.el9_0.1) to remediate these issues. The advisory references bugzilla entries for each CVE and provides SHA-256 hashes for the updated packages. The vulnerabilities are rated as important by Red Hat, with a high severity level indicated. No known exploits in the wild have been reported at the time of the advisory.

Successful exploitation of these vulnerabilities can cause denial of service conditions in the Dovecot server, potentially disrupting email services. The issues affect the ManageSieve authentication mechanism and IMAP commands, allowing crafted inputs to cause service interruptions. There is no indication of privilege escalation or data disclosure. The impact is limited to service availability degradation.

Red Hat has released updated Dovecot packages for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions to address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:17630 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the official update.