Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. 

Security Fix(es):

* dovecot: Doveadm: Full access via timing oracle attack in credential verification (CVE-2026-27856)

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)

* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: dovecot security update

Multiple denial of service vulnerabilities have been identified in Dovecot, an IMAP and POP3 server for Linux and UNIX-like systems. These include issues in the ManageSieve plugin via crafted SASL initial response during authentication, denial of service via crafted messages before authentication, and denial of service through specially crafted NOOP commands. The vulnerabilities affect Red Hat Enterprise Linux 8.4 versions with Dovecot packages. Red Hat has issued a security advisory with updates addressing these issues.

Multiple denial of service vulnerabilities have been identified in Dovecot, an IMAP and POP3 server for Linux and UNIX-like systems. These include a denial of service via a crafted SASL initial response in the AUTHENTICATE command (CVE-2025-59032), denial of service via a crafted message before authentication (CVE-2026-27858), and denial of service via a specially crafted NOOP command (CVE-2026-27857). These issues affect Red Hat Enterprise Linux 8.6 variants. Red Hat has released security updates addressing these vulnerabilities.

dovecot

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. 

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)

* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

security update for dovecot

Multiple denial of service vulnerabilities have been identified in Dovecot, an IMAP and POP3 server for Linux and UNIX-like systems. These issues include a crafted SASL initial response in the AUTHENTICATE command, a crafted message before authentication, and a specially crafted NOOP command. Red Hat has issued a security advisory with updates addressing these vulnerabilities in Red Hat Enterprise Linux 8.8 variants. The vulnerabilities are rated as having an important security impact.

Multiple denial of service vulnerabilities have been identified in Dovecot, an IMAP and POP3 server for Linux and UNIX-like systems. These include a crafted SASL initial response in the AUTHENTICATE command affecting ManageSieve (CVE-2025-59032), a crafted message before authentication (CVE-2026-27858), and a specially crafted NOOP command (CVE-2026-27857). These vulnerabilities could allow an attacker to cause denial of service conditions. Red Hat has issued a security update addressing these issues in Dovecot packages for Red Hat Enterprise Linux 9.2 and related variants.

Multiple denial of service vulnerabilities have been identified in Dovecot, an IMAP and POP3 server for Linux and UNIX-like systems. These include a denial of service via a crafted SASL initial response in the AUTHENTICATE command (CVE-2025-59032), denial of service via a crafted message before authentication (CVE-2026-27858), and denial of service via a specially crafted NOOP command (CVE-2026-27857). Red Hat has issued a security advisory providing updates to address these issues in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The vulnerabilities are rated with high severity by Red Hat Product Security. No CVSS scores are provided in the advisory. The update is available for affected Red Hat Enterprise Linux 9.0 packages.

Multiple denial of service vulnerabilities have been identified in Dovecot, an IMAP and POP3 server for UNIX-like systems. These include a ManageSieve denial of service via a crafted SASL initial response in the AUTHENTICATE command (CVE-2025-59032), denial of service via a crafted message before authentication (CVE-2026-27858), and denial of service via a specially crafted NOOP command (CVE-2026-27857). A security update addressing these issues is available for Red Hat Enterprise Linux 9.6 Extended Update Support and related products.

dovecot-devel

dovecot-mysql

dovecot-pgsql

dovecot-pigeonhole

Dovecot, an IMAP and POP3 server for UNIX-like systems, has a security vulnerability (CVE-2025-59032) involving a denial of service via a crafted SASL initial response in the AUTHENTICATE command of the ManageSieve plugin. This issue is part of a set of denial of service vulnerabilities fixed in an update. The vulnerability affects versions prior to 1:2.3.16-15.el9_7.1. A security update is available from Red Hat to address this issue.

Important: dovecot security update (CVE-2025-59032)

Dovecot, an IMAP and POP3 server for UNIX-like systems, has a security update addressing a denial of service vulnerability (CVE-2025-59032) in the ManageSieve component. This flaw allows denial of service via a crafted SASL initial response in the AUTHENTICATE command. Additional denial of service issues (CVE-2026-27857 and CVE-2026-27858) related to crafted NOOP commands and messages before authentication are also fixed. The update is rated as Important by Red Hat and affects versions prior to 1:2.3.16-7.el8_10.

Dovecot, an IMAP and POP3 server for UNIX-like systems, has a security vulnerability (CVE-2025-59032) involving a denial of service via a crafted SASL initial response in the AUTHENTICATE command of ManageSieve. This issue is part of a set of denial of service vulnerabilities addressed in a security update. The vulnerability affects versions prior to 1:2.3.21-16.el10_1.1 and has been fixed in that release.

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.

Search: CVE-2025-59032