Dovecot

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomple

Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_all

Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This l

A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably forma

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount

Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands wi

Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can u

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and usern

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows

When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or s

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSi

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachmen

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentica