There are four security advisories for Dovecot.
1. CVE-2026-52681: - CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) - Details: Sieve resource usage tracking lost when active script changes. An attacker with valid credentials can reset the accounting by repeatedly changing the active script. - Risk: The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. - Solution: Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version.
2. CVE-2026-42392: - CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - Details: imap-urlauth leaks memory into user-visible error messages. An attacker with valid credentials can send an invalid IMAP URLFETCH command. - Risk: Process memory contents can be disclosed to the client, which may include sensitive data. - Solution: Disable the IMAP URLAUTH functionality. Update to non-vulnerable version.
3. CVE-2026-73208: - CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) - Details: auth: db-oauth2: aud claim used as fallback for missing scope claim. An attacker can authenticate using a token intended for a different purpose. - Risk: A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name. - Solution: Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version.
4. CVE-2026-73209: - CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - Details: imap-login crash: Self-recursion on zero-output decompress chunks. An attacker with valid credentials can send crafted compressed data. - Risk: The affected process is terminated, which can cause degradation or denial of service for IMAP. - Solution: Update to non-vulnerable version.
5. CVE-2026-42391: - CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - Details: imap: Pre-login memory/CPU growth with ID command. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. - Risk: The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. - Solution: Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version.
6. CVE-2026-52687: - CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - Details: IMAP: COMPRESS ZSTD can cause excessive memory usage. An attacker with valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory. - Risk: The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. - Solution: Disable IMAP compression. Alternatively, limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version.