Skip to content
Heist/ feed
UnratedFix available

Security update for dovecot23

Type: advisorySource: OSV1 source record

This update for dovecot23 fixes the following issues: - CVE-2024-23184: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive (bsc#1229184). - CVE-2024-23185: large headers can cause resource exhaustion when parsing message (bsc#1229183). - CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894). - CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing (bsc#1260895). - CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902). - CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799). - CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900). - CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899). - CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898). - CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901). - CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897). - CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached (bsc#1276794). - CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147). - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing (bsc#1276802). - CVE-2026-33605: managesieve

Announced Group revision 1
Original source ↗

SUSE-SU-2026:4139-1

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:SUSE-SU-2026:4139-1

dovecot23

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/4/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/4/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/5/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/5/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/6/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/6/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/7/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/7/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/8/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/8/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/9/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/9/ranges

Prerequisites
Not stated in this record

dovecot23

Source reference: /affected/10/package/name

Affected versions
Not stated in this record
Fixed versions
2.3.21.1-150200.76.1

Source reference: /affected/10/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7",
      "ecosystem": "SUSE:Linux Enterprise Module for Server Applications 15 SP7"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS",
      "ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS",
      "ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS",
      "ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS",
      "ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS",
      "ecosystem": "SUSE:Linux Enterprise Server 15 SP4-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS",
      "ecosystem": "SUSE:Linux Enterprise Server 15 SP5-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS",
      "ecosystem": "SUSE:Linux Enterprise Server 15 SP6-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4",
      "ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP4"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5",
      "ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP5"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.21.1-150200.76.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot23",
      "purl": "pkg:rpm/suse/dovecot23&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6",
      "ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP6"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4139-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "dovecot23": "2.3.21.1-150200.76.1",
          "dovecot23-fts": "2.3.21.1-150200.76.1",
          "dovecot23-devel": "2.3.21.1-150200.76.1",
          "dovecot23-fts-solr": "2.3.21.1-150200.76.1",
          "dovecot23-fts-squat": "2.3.21.1-150200.76.1",
          "dovecot23-fts-lucene": "2.3.21.1-150200.76.1",
          "dovecot23-backend-mysql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-pgsql": "2.3.21.1-150200.76.1",
          "dovecot23-backend-sqlite": "2.3.21.1-150200.76.1"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#23487 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. SUSE-SU-2026:4139-1 · Revision 1Source updated