Threat Intelligence Database

CVE-2026-42006 is a vulnerability in the Dovecot IMAP server that allows an attacker to cause uncontrolled memory usage by sending excessive bracing characters over IMAP. The previous fix for a related issue was incomplete, leaving a bypass via open braces. This can lead to memory consumption up to the configured memory limit, resulting in a denial of service. No public exploits are known. Red Hat has released security updates addressing this issue for multiple versions of Red Hat Enterprise Linux and related products.

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple denial of service vulnerabilities have been identified in Dovecot, an IMAP and POP3 server for Linux and UNIX-like systems. These include a crafted SASL initial response in the AUTHENTICATE command affecting ManageSieve (CVE-2025-59032), a crafted message before authentication (CVE-2026-27858), and a specially crafted NOOP command (CVE-2026-27857). These vulnerabilities could allow an attacker to cause denial of service conditions. Red Hat has issued a security update addressing these issues in Dovecot packages for Red Hat Enterprise Linux 9.2 and related variants.

Multiple denial of service vulnerabilities have been identified in Dovecot, an IMAP and POP3 server for Linux and UNIX-like systems. These include a denial of service via a crafted SASL initial response in the AUTHENTICATE command (CVE-2025-59032), denial of service via a crafted message before authentication (CVE-2026-27858), and denial of service via a specially crafted NOOP command (CVE-2026-27857). Red Hat has issued a security advisory providing updates to address these issues in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The vulnerabilities are rated with high severity by Red Hat Product Security. No CVSS scores are provided in the advisory. The update is available for affected Red Hat Enterprise Linux 9.0 packages.

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Two vulnerabilities in Dovecot, an IMAP and POP3 server, can lead to denial of service or resource exhaustion. CVE-2024-23184 involves triggering denial of service by using a large number of address headers. CVE-2024-23185 involves resource exhaustion caused by very large headers during message parsing. These issues affect Red Hat Enterprise Linux 9 and related variants. A security update addressing these vulnerabilities is available from Red Hat.