Threats Tagged 'cve-2026-42007'

Multiple critical security vulnerabilities affecting Dovecot 2.4.4 and related versions in Red Hat Enterprise Linux 8 have been addressed in an update to version 2.3.16-16.el8_10. These vulnerabilities include denial of service, authentication bypass, and remote code execution issues across various Dovecot components such as IMAP, ManageSieve, and sieve scripts. The update fixes critical issues including a use-after-free leading to arbitrary code execution and several denial of service vulnerabilities caused by malformed inputs or resource exhaustion.

CVE-2026-42007 is a critical use-after-free vulnerability in Open-Xchange GmbH's OX Dovecot Pro affecting versions 2.3.0, 3.0.0, and 3.1.0. An attacker with valid credentials can exploit the Sieve editheader extension to cause memory corruption during mail delivery, potentially leading to arbitrary code execution or process crashes. No public exploits are known. Mitigation includes disabling the Sieve editheader extension and updating to a non-vulnerable version.

CVE-2026-42007 is a critical use-after-free vulnerability in Open-Xchange GmbH's OX Dovecot Pro. An attacker with valid credentials can exploit the Sieve editheader extension to cause memory corruption during mail delivery, potentially leading to arbitrary code execution. The vulnerability can crash the mail delivery process and leak memory. Disabling the Sieve editheader extension or updating to a non-vulnerable version mitigates the issue. No public exploits are currently known.