Red Hat Security Advisory

RHSA-2026:17602

dovecot security update

Released 2026-05-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v. 10.0) dovecot-1:2.3.21-16.el10_0.1, dovecot-mysql-1:2.3.21-16.el10_0.1, dovecot-pgsql-1:2.3.21-16.el10_0.1 +1
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dovecot-devel-1:2.3.21-16.el10_0.1

TI-2026-22208 CVE-2026-27858 · GHSA-xr7v-hj32-mr4r

MEDIUM 40

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00804 Published 2026-03-27 Partial fix CWE-400

TI-2025-36674 CVE-2025-59032 · GHSA-w2gj-cmfm-c4j4

MEDIUM 40

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0073 Published 2026-03-27 Partial fix CWE-20

TI-2026-22207 CVE-2026-27857 · GHSA-j26c-8p6m-gpfj

LOW 34

Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00679 Published 2026-03-27 Partial fix CWE-400