Security update for dovecot24
This update for dovecot24 fixes the following issues: Update to 2.4.5. - CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794). - CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799). - CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802). - CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809). - CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800). - CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795). - CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807). - CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804). - CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812). - CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813). - CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810). - CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text (bsc#1276815). - CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819). - CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820). - CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817). - CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824). - CVE-2026-
SUSE-SU-2026:23595-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:23595-1
dovecot24
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.4-160000.2.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
dovecot24
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.4-160000.2.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.4-160000.2.1"
}
]
}
],
"package": {
"name": "dovecot24",
"purl": "pkg:rpm/suse/dovecot24&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23595-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"dovecot24": "2.4.4-160000.2.1",
"dovecot24-fts": "2.4.4-160000.2.1",
"dovecot24-devel": "2.4.4-160000.2.1",
"dovecot24-fts-solr": "2.4.4-160000.2.1",
"dovecot24-backend-mysql": "2.4.4-160000.2.1",
"dovecot24-backend-pgsql": "2.4.4-160000.2.1",
"dovecot24-backend-sqlite": "2.4.4-160000.2.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.4-160000.2.1"
}
]
}
],
"package": {
"name": "dovecot24",
"purl": "pkg:rpm/suse/dovecot24&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23595-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"dovecot24": "2.4.4-160000.2.1",
"dovecot24-fts": "2.4.4-160000.2.1",
"dovecot24-devel": "2.4.4-160000.2.1",
"dovecot24-fts-solr": "2.4.4-160000.2.1",
"dovecot24-backend-mysql": "2.4.4-160000.2.1",
"dovecot24-backend-pgsql": "2.4.4-160000.2.1",
"dovecot24-backend-sqlite": "2.4.4-160000.2.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #30868 · Revision 1
- Added to Heist Feed
- Publisher date