{"schemaVersion":3,"id":"OPENSUSE-SU-2026:21720-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for dovecot24\n\nThis update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).","dates":{"published":"2026-09-01T14:18:02.000Z","modified":"2026-09-02T18:00:03.648Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"dovecot24&distro=openSUSE Leap 16.0","name":"dovecot24","label":"dovecot24&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/dovecot24&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 2.4.4-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.4-160000.2.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.suse.com/1276794","label":"bugzilla.suse.com/1276794","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276795","label":"bugzilla.suse.com/1276795","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276799","label":"bugzilla.suse.com/1276799","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276800","label":"bugzilla.suse.com/1276800","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276802","label":"bugzilla.suse.com/1276802","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276804","label":"bugzilla.suse.com/1276804","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276807","label":"bugzilla.suse.com/1276807","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276809","label":"bugzilla.suse.com/1276809","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276810","label":"bugzilla.suse.com/1276810","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276812","label":"bugzilla.suse.com/1276812","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276813","label":"bugzilla.suse.com/1276813","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276815","label":"bugzilla.suse.com/1276815","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276817","label":"bugzilla.suse.com/1276817","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276819","label":"bugzilla.suse.com/1276819","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276820","label":"bugzilla.suse.com/1276820","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276824","label":"bugzilla.suse.com/1276824","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276826","label":"bugzilla.suse.com/1276826","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276827","label":"bugzilla.suse.com/1276827","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276828","label":"bugzilla.suse.com/1276828","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276829","label":"bugzilla.suse.com/1276829","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276830","label":"bugzilla.suse.com/1276830","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276833","label":"bugzilla.suse.com/1276833","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276835","label":"bugzilla.suse.com/1276835","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276837","label":"bugzilla.suse.com/1276837","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27852","label":"www.suse.com/security/cve/CVE-2026-27852","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33263","label":"www.suse.com/security/cve/CVE-2026-33263","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33604","label":"www.suse.com/security/cve/CVE-2026-33604","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33605","label":"www.suse.com/security/cve/CVE-2026-33605","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33606","label":"www.suse.com/security/cve/CVE-2026-33606","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33607","label":"www.suse.com/security/cve/CVE-2026-33607","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40013","label":"www.suse.com/security/cve/CVE-2026-40013","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40014","label":"www.suse.com/security/cve/CVE-2026-40014","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40015","label":"www.suse.com/security/cve/CVE-2026-40015","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40017","label":"www.suse.com/security/cve/CVE-2026-40017","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40018","label":"www.suse.com/security/cve/CVE-2026-40018","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40203","label":"www.suse.com/security/cve/CVE-2026-40203","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40204","label":"www.suse.com/security/cve/CVE-2026-40204","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40205","label":"www.suse.com/security/cve/CVE-2026-40205","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42007","label":"www.suse.com/security/cve/CVE-2026-42007","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42008","label":"www.suse.com/security/cve/CVE-2026-42008","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42391","label":"www.suse.com/security/cve/CVE-2026-42391","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42392","label":"www.suse.com/security/cve/CVE-2026-42392","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42393","label":"www.suse.com/security/cve/CVE-2026-42393","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42395","label":"www.suse.com/security/cve/CVE-2026-42395","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52681","label":"www.suse.com/security/cve/CVE-2026-52681","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52687","label":"www.suse.com/security/cve/CVE-2026-52687","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73208","label":"www.suse.com/security/cve/CVE-2026-73208","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73209","label":"www.suse.com/security/cve/CVE-2026-73209","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-27852","CVE-2026-33263","CVE-2026-33604","CVE-2026-33605","CVE-2026-33606","CVE-2026-33607","CVE-2026-40013","CVE-2026-40014","CVE-2026-40015","CVE-2026-40017","CVE-2026-40018","CVE-2026-40203","CVE-2026-40204","CVE-2026-40205","CVE-2026-42007","CVE-2026-42008","CVE-2026-42391","CVE-2026-42392","CVE-2026-42393","CVE-2026-42395","CVE-2026-52681","CVE-2026-52687","CVE-2026-73208","CVE-2026-73209"],"downstream":[],"duplicates":[],"related":["CVE-2026-27852","CVE-2026-33263","CVE-2026-33604","CVE-2026-33605","CVE-2026-33606","CVE-2026-33607","CVE-2026-40013","CVE-2026-40014","CVE-2026-40015","CVE-2026-40017","CVE-2026-40018","CVE-2026-40203","CVE-2026-40204","CVE-2026-40205","CVE-2026-42007","CVE-2026-42008","CVE-2026-42391","CVE-2026-42392","CVE-2026-42393","CVE-2026-42395","CVE-2026-52681","CVE-2026-52687","CVE-2026-73208","CVE-2026-73209"]},"timeline":[{"kind":"published","date":"2026-09-01T14:18:02.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-02T18:00:03.648Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T10:36:07.030Z","stale":false,"partial":false}}