CVE-2026-27851: dovecot Improper Handling of Extra Parameters
Vulnerability summary
CVE-2026-27851 is a critical (CVSS 9.1) Improper Handling of Extra Parameters vulnerability in dovecot. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 4Timeline
- 12-05-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.17 pp
From 0.41% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-235Improper Handling of Extra ParametersThe product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Affected systems
Alpine1 product
- dovecot< 2.4.4-r0
Debian1 product
- dovecot< 1:2.4.1+dfsg1-6+deb13u6 | < 1:2.4.4+dfsg1-1
Dovecot1 product
- dovecot< 2.4.4
Open-xchange1 product
- dovecot< 3.1.5
Open-xchange gmbh1 product
- ox dovecot pro≤ 3.1.4 | ≤ 2.4.3
Ubuntu1 product
- dovecot< 1:2.4.1+dfsg1-5ubuntu4.2 | < 1:2.4.2+dfsg1-3ubuntu2.1
6 vendors · 6 products
