Critical Security Update for Dovecot: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:19364: Important: dovecot security update. Affects dovecot versions < 1:2.3.16-18.el9_8. Fixed in 1:2.3.16-18.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is a widely used IMAP server designed for Linux and UNIX-like systems, emphasizing security and performance. It also includes a POP3 server and supports various email formats, such as maildir and mbox. Dovecot's architecture allows for extensibility through SQL drivers and authentication plugins, making it a popular choice for email services. However, recent vulnerabilities have been identified that could compromise its stability and security.
Vulnerability Detail
The vulnerabilities in Dovecot stem from improper handling of specific commands and responses, leading to potential Denial of Service (DoS) attacks. The issues include a crafted SASL initial response in the AUTHENTICATE command (CVE-2025-59032), crafted messages before authentication (CVE-2026-27858), and specially crafted NOOP commands (CVE-2026-27857). These vulnerabilities can cause the server to become unresponsive, impacting email services and user access.
How To Fix
Minimum fixed version
1:2.3.16-18.el9_8
This is the first release that contains the fix.
sudo dnf update dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the Dovecot server or implement firewall rules to restrict traffic until the update is applied. Additionally, monitoring server logs for unusual activity can help mitigate the impact of these vulnerabilities.
Conclusion
In summary, the recent vulnerabilities in Dovecot pose significant risks to email services through potential Denial of Service attacks. It is crucial to update to the patched version to ensure the security and stability of your email server. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for dovecot →
FAQ
Dovecot is an open-source IMAP and POP3 server for Unix-like operating systems, designed with a focus on security and performance.
The vulnerabilities can lead to Denial of Service attacks, causing the Dovecot server to become unresponsive and disrupting email services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing firewall rules to restrict access and monitor server logs for any suspicious activity.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory, including CVE-2025-59032, CVE-2026-27857, and CVE-2026-27858.
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
