ALPINE-CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
ALPINE-CVE-2026-42393
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALPINE-CVE-2026-42393
dovecot
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.5-r0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
dovecot
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.5-r0
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.5-r0"
}
]
}
],
"package": {
"name": "dovecot",
"purl": "pkg:apk/alpine/dovecot?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-42393.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.5-r0"
}
]
}
],
"package": {
"name": "dovecot",
"purl": "pkg:apk/alpine/dovecot?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-42393.json"
},
"ecosystem_specific": {}
}
]Publisher severity
No explicit severity was provided.
- Event
- #54378 · Revision 1
- Added to Heist Feed
- Publisher date