Dovecot vulnerabilities
69 vulnerabilities
Known vulnerabilities in Dovecot products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Dovecot69 vulnerabilities
- Pigeonhole1 vulnerabilities
CVE-2013-2111ubuntudovecot+1
EPSS score2.43%
The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via invalid APPEND parameters.CVE-2013-6171debiandovecot+2EPSS score1.46%
checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server.CVE-2021-29157alpinedovecot+3EPSS score0.47%
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.CVE-2021-33515alpinedovecot+15EPSS score2.85%
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.CVE-2015-3420debiandovecot+2EPSS score2.84%
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.CVE-2007-2231debiandovecot+1EPSS score2.12%
Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.CVE-2007-4211debiandovecot+1EPSS score1.38%
The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command.CVE-2007-6598debiandovecot+1EPSS score1.96%
Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.CVE-2016-4983dovecotdovecot+11EPSS score0.40%
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.CVE-2016-8652debiandovecot+1EPSS score48.20%
The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.CVE-2025-59032debiandovecot+4EPSS score0.70%
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.CVE-2025-59028alpinedovecot+5EPSS score0.45%
When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.CVE-2025-59031alpinedovecot+5EPSS score0.28%
Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.CVE-2020-25275alpinedovecot+5EPSS score4.72%
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.CVE-2020-7046alpinedovecot+2EPSS score51.26%
lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.CVE-2020-7957alpinedovecot+2EPSS score1.88%
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.CVE-2020-10957alpinedovecot+13EPSS score7.17%
In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.CVE-2020-10958alpinedovecot+3EPSS score6.12%
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.CVE-2020-10967alpinedovecot+3EPSS score8.15%
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.CVE-2020-24386alpinedovecot+23EPSS score2.78%
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).