Critical Security Update for Dovecot: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:19149: Important: dovecot security update. Affects dovecot versions < 1:2.3.21-19.el10_2. Fixed in 1:2.3.21-19.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is a widely-used IMAP server designed for Linux and UNIX-like systems, emphasizing security and performance. It also includes a POP3 server and supports email formats such as maildir and mbox. Dovecot is known for its extensibility through SQL drivers and authentication plugins, making it a popular choice for email services. However, recent vulnerabilities have been identified that could potentially compromise its stability and security.
Vulnerability Detail
The vulnerabilities in Dovecot include a Denial of Service (DoS) attack via a crafted SASL initial response in the AUTHENTICATE command (CVE-2025-59032), a DoS via a crafted message before authentication (CVE-2026-27858), and a DoS via a specially crafted NOOP command (CVE-2026-27857). These vulnerabilities could allow an attacker to disrupt service availability, leading to significant operational impacts for affected systems.
How To Fix
Minimum fixed version
1:2.3.21-19.el10_2
This is the first release that contains the fix.
sudo dnf update dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the Dovecot server by configuring firewall rules to restrict incoming connections to trusted IP addresses. This can help mitigate the risk of exploitation until the update is applied.
Conclusion
In summary, the recent vulnerabilities identified in Dovecot pose significant risks, particularly in terms of Denial of Service attacks. It is crucial for users to update to the latest patched version to safeguard their systems. Implementing temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for dovecot →
FAQ
Dovecot is an open-source IMAP and POP3 server for Unix-like operating systems, designed with a focus on security and performance.
The vulnerabilities include Denial of Service attacks that can be triggered by crafted commands or messages, potentially disrupting service availability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing firewall rules to restrict access to the Dovecot server as a temporary workaround.
For more details, refer to the CVE pages listed in the references section of the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
