SUSE-SU-2026:23595-1
Security update for dovecot24
Severity by source
No source gives a CVSS score.
Trivy's own label is CRITICAL. Rated critical by SUSE.
Description
This update for dovecot24 fixes the following issues: Update to 2.4.5. - CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794). - CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799). - CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802). - CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809). - CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800). - CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795). - CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807). - CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804). - CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812). - CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813). - CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810). - CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text (bsc#1276815). - CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819). - CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820). - CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817). - CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824). - CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835). - CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829). - CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827). - CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837). - CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826). - CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828). - CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830). - CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise 16.0 | dovecot24, dovecot24-backend-mysql, dovecot24-backend-pgsql and 4 more | 2.4.4-160000.2.1 |
Show all 7 entries from 1 source
| Source | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise 16.0 | dovecot24 | 2.4.4-160000.2.1 |
| SUSE Linux Enterprise 16.0 | dovecot24-backend-mysql | 2.4.4-160000.2.1 |
| SUSE Linux Enterprise 16.0 | dovecot24-backend-pgsql | 2.4.4-160000.2.1 |
| SUSE Linux Enterprise 16.0 | dovecot24-backend-sqlite | 2.4.4-160000.2.1 |
| SUSE Linux Enterprise 16.0 | dovecot24-devel | 2.4.4-160000.2.1 |
| SUSE Linux Enterprise 16.0 | dovecot24-fts | 2.4.4-160000.2.1 |
| SUSE Linux Enterprise 16.0 | dovecot24-fts-solr | 2.4.4-160000.2.1 |
References
- https://bugzilla.suse.com/1276794
- https://bugzilla.suse.com/1276795
- https://bugzilla.suse.com/1276799
- https://bugzilla.suse.com/1276800
- https://bugzilla.suse.com/1276802
- https://bugzilla.suse.com/1276804
- https://bugzilla.suse.com/1276807
- https://bugzilla.suse.com/1276809
All 51 references
- https://bugzilla.suse.com/1276810
- https://bugzilla.suse.com/1276812
- https://bugzilla.suse.com/1276813
- https://bugzilla.suse.com/1276815
- https://bugzilla.suse.com/1276817
- https://bugzilla.suse.com/1276819
- https://bugzilla.suse.com/1276820
- https://bugzilla.suse.com/1276824
- https://bugzilla.suse.com/1276826
- https://bugzilla.suse.com/1276827
- https://bugzilla.suse.com/1276828
- https://bugzilla.suse.com/1276829
- https://bugzilla.suse.com/1276830
- https://bugzilla.suse.com/1276833
- https://bugzilla.suse.com/1276835
- https://bugzilla.suse.com/1276837
- https://lists.suse.com/pipermail/sle-security-updates/2026-September/029091.html
- https://www.suse.com/security/cve/CVE-2026-27852/
- https://www.suse.com/security/cve/CVE-2026-33263/
- https://www.suse.com/security/cve/CVE-2026-33604/
- https://www.suse.com/security/cve/CVE-2026-33605/
- https://www.suse.com/security/cve/CVE-2026-33606/
- https://www.suse.com/security/cve/CVE-2026-33607/
- https://www.suse.com/security/cve/CVE-2026-40013/
- https://www.suse.com/security/cve/CVE-2026-40014/
- https://www.suse.com/security/cve/CVE-2026-40015/
- https://www.suse.com/security/cve/CVE-2026-40017/
- https://www.suse.com/security/cve/CVE-2026-40018/
- https://www.suse.com/security/cve/CVE-2026-40203/
- https://www.suse.com/security/cve/CVE-2026-40204/
- https://www.suse.com/security/cve/CVE-2026-40205/
- https://www.suse.com/security/cve/CVE-2026-42007/
- https://www.suse.com/security/cve/CVE-2026-42008/
- https://www.suse.com/security/cve/CVE-2026-42391/
- https://www.suse.com/security/cve/CVE-2026-42392/
- https://www.suse.com/security/cve/CVE-2026-42393/
- https://www.suse.com/security/cve/CVE-2026-42395/
- https://www.suse.com/security/cve/CVE-2026-52681/
- https://www.suse.com/security/cve/CVE-2026-52687/
- https://www.suse.com/security/cve/CVE-2026-73208/
- https://www.suse.com/security/cve/CVE-2026-73209/
- https://www.suse.com/support/security/rating/
- https://www.suse.com/support/update/announcement/2026/suse-su-202623595-1/