Critical Security Flaw in Dovecot IMAP Server: Multiple Vulnerabilities Identified
Summary
RLSA-2026:79371: Important: dovecot security update. Affects dovecot versions < 1:2.3.21-19.el10_2.8. Fixed in 1:2.3.21-19.el10_2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is a widely used IMAP server designed for Linux and UNIX-like systems, emphasizing security and performance. It also includes a POP3 server and supports various email formats, such as maildir and mbox. The software is modular, allowing for SQL drivers and authentication plugins as subpackages. However, recent vulnerabilities have been identified that could compromise its integrity and availability.
Vulnerability Detail
The vulnerabilities in Dovecot include a denial of service via excessive IMAP ID command parameters, an authentication bypass due to incorrect OAuth2 token validation, and multiple denial of service issues stemming from crafted email headers and connection limit exhaustion. Additionally, there is a risk of arbitrary code execution due to a use-after-free error in the Sieve editheader function. These vulnerabilities can lead to service disruptions, unauthorized access, and potential data loss.
How To Fix
Minimum fixed version
1:2.3.21-19.el10_2.8
This is the first release that contains the fix.
sudo dnf update dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the number of connections to the Dovecot server to mitigate the risk of connection limit exhaustion. This can be done by adjusting the configuration file located at '/etc/dovecot/dovecot.conf' and setting a lower connection limit.
Conclusion
The recent vulnerabilities identified in Dovecot pose significant risks to email services, including potential denial of service and unauthorized access. It is crucial for users to update to the latest patched version to mitigate these risks and maintain the security of their systems.
See every vulnerability recorded for dovecot →
FAQ
Dovecot is an open-source IMAP and POP3 server for Unix-like operating systems, designed to provide secure and efficient email services.
The vulnerabilities include denial of service attacks, authentication bypass, and arbitrary code execution, which can severely impact the server's functionality.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for the vulnerabilities in Dovecot is 9.1, indicating a critical level of severity.
It is recommended to regularly check for updates and apply them promptly to ensure your Dovecot server remains secure against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
