Threats affecting pkg:rpm/redhat/dovecot

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Two vulnerabilities in Dovecot, an IMAP and POP3 server, can lead to denial of service or resource exhaustion. CVE-2024-23184 allows denial of service by using a large number of address headers. CVE-2024-23185 causes resource exhaustion due to very large headers during message parsing. These issues affect Red Hat Enterprise Linux 9 and related variants. A security update addressing these vulnerabilities is available from Red Hat.