{"schemaVersion":3,"id":"USN-8365-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"dovecot vulnerabilities\n\nIt was discovered that Dovecot incorrectly treated some variable expansion\npipelines as safe in authentication filters. An attacker could possibly use\nthis issue to perform SQL or LDAP injection attacks. This issue only\naffected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-27851)\n\nIt was discovered that Dovecot incorrectly verified SCRAM TLS channel\nbinding in certain base64 exchanges. A remote attacker could possibly use\nthis issue to obtain sensitive information in a machine-in-the-middle\nattack. (CVE-2026-33603)\n\nIt was discovered that Dovecot incorrectly enforced Sieve script CPU\nlimits. An attacker could possibly use this issue to cause Dovecot to use\nexcessive resources, leading to a denial of service. (CVE-2026-40016)\n\nIt was discovered that Dovecot incorrectly handled certain IMAP SETACL\ncommands. An attacker could possibly use this issue to spam folders to\nother users. (CVE-2026-40020)\n\nIt was discovered that Dovecot incorrectly handled excessive IMAP bracing.\nAn attacker could possibly use this issue to cause Dovecot to use excessive\nresources, leading to a denial of service. (CVE-2026-42006)","dates":{"published":"2026-06-02T12:42:17.000Z","modified":"2026-06-30T18:16:45.062Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"dovecot","name":"dovecot","label":"dovecot","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dovecot","purlType":"deb","versions":[{"text":"< 1:2.3.16+dfsg1-3ubuntu2.9","noFixRecorded":false,"fixedIn":null},{"text":"< 1:2.3.21+dfsg1-2ubuntu6.5","noFixRecorded":false,"fixedIn":null},{"text":"< 1:2.4.1+dfsg1-5ubuntu4.2","noFixRecorded":false,"fixedIn":null},{"text":"< 1:2.4.2+dfsg1-3ubuntu2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:2.3.16+dfsg1-3ubuntu2.9 | < 1:2.3.21+dfsg1-2ubuntu6.5 | < 1:2.4.1+dfsg1-5ubuntu4.2 | < 1:2.4.2+dfsg1-3ubuntu2.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8365-1","label":"ubuntu.com/security/notices/USN-8365-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27851","label":"ubuntu.com/security/CVE-2026-27851","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-33603","label":"ubuntu.com/security/CVE-2026-33603","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-40016","label":"ubuntu.com/security/CVE-2026-40016","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-40020","label":"ubuntu.com/security/CVE-2026-40020","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-42006","label":"ubuntu.com/security/CVE-2026-42006","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2026-27851","CVE-2026-33603","CVE-2026-40016","CVE-2026-40020","CVE-2026-42006"]},"timeline":[{"kind":"published","date":"2026-06-02T12:42:17.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-30T18:16:45.062Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T07:53:24.485Z","stale":false,"partial":false}}