CVE-2026-73209 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process i… |
CVE-2026-73208 | High | 7.4 | 2026-08-28 | An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the aud… |
CVE-2026-52687 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory… |
CVE-2026-52681 | Low | 3.1 | 2026-08-28 | Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the activ… |
CVE-2026-42395 | Medium | 4.3 | 2026-08-28 | A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The log… |
CVE-2026-42393 | Low | 3.1 | 2026-08-28 | The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access t… |
CVE-2026-42392 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response return… |
CVE-2026-42391 | High | 7.5 | 2026-08-28 | An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow dis… |
CVE-2026-42008 | Medium | 4.3 | 2026-08-28 | Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that ho… |
CVE-2026-42007 | Critical | 9.1 | 2026-08-28 | An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write… |
CVE-2026-40205 | Medium | 5.9 | 2026-08-28 | An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configur… |
CVE-2026-40204 | Low | 3.1 | 2026-08-28 | None None None No publicly available exploits are known. |
CVE-2026-40203 | Low | 3.7 | 2026-08-28 | When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail a… |
CVE-2026-40019 | Medium | 5.9 | 2026-08-28 | An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This… |
CVE-2026-40018 | High | 7.4 | 2026-08-28 | None None None No publicly available exploits are known. |
CVE-2026-40017 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD c… |
CVE-2026-40015 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out… |
CVE-2026-40014 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message… |
CVE-2026-40013 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSiev… |
CVE-2026-33607 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for a… |
CVE-2026-33606 | Medium | 4.8 | 2026-08-28 | Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protoc… |
CVE-2026-33605 | High | 7.5 | 2026-08-28 | An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mod… |
CVE-2026-33604 | Medium | 5.9 | 2026-08-28 | An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body… |
CVE-2026-33263 | Medium | 4.3 | 2026-08-28 | When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If r… |
CVE-2026-27852 | High | 7.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes exce… |
CVE-2026-42006 | Medium | 4.3 | 2026-05-12 | An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this… |
CVE-2026-40020 | Low | 3.1 | 2026-05-12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be… |
CVE-2026-40016 | Medium | 5.3 | 2026-05-12 | Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the config… |
CVE-2026-33603 | Medium | 6.8 | 2026-05-12 | Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to p… |
CVE-2026-27851 | High | 7.4 | 2026-05-12 | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to b… |
CVE-2026-27860 | Low | 3.7 | 2026-03-27 | If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restricti… |
CVE-2026-27859 | Medium | 5.3 | 2026-03-27 | A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message causes mail delivery… |
CVE-2026-27858 | High | 7.5 | 2026-03-27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
Attacker can force manages… |
CVE-2026-27857 | Medium | 4.3 | 2026-03-27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This… |
CVE-2026-27856 | High | 7.4 | 2026-03-27 | Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured cre… |
CVE-2026-27855 | Medium | 6.8 | 2026-03-27 | Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP cred… |
CVE-2026-24031 | High | 7.7 | 2026-03-27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user… |
CVE-2026-0394 | Medium | 5.3 | 2026-03-27 | When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characte… |
CVE-2025-59032 | High | 7.5 | 2026-03-27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unava… |
CVE-2025-59031 | Medium | 4.3 | 2026-03-27 | Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted… |
CVE-2025-59028 | Medium | 5.3 | 2026-03-27 | When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 d… |
CVE-2025-59026 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-59025 | Medium | 6.1 | 2025-11-27 | Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of… |
CVE-2025-30190 | Medium | 5.4 | 2025-11-27 | Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users… |
CVE-2025-30186 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-30191 | Medium | 5.4 | 2025-10-31 | Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information t… |
CVE-2025-30189 | High | 7.4 | 2025-10-31 | When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users… |
CVE-2025-30188 | High | 7.5 | 2025-10-31 | Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the w… |
CVE-2024-23185 | High | 7.5 | 2024-09-10 | Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when… |
CVE-2024-23184 | Medium | 5.0 | 2024-09-10 | Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, a… |
CVE-2024-25584 | Medium | 5.3 | 2024-09-06 | Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail… |
CVE-2024-25582 | Medium | 5.4 | 2024-08-19 | Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or e… |
CVE-2024-23193 | Medium | 5.3 | 2024-05-06 | E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node… |
CVE-2024-23188 | Medium | 6.5 | 2024-05-06 | Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interacti… |
CVE-2024-23187 | Medium | 6.5 | 2024-05-06 | Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perfor… |
CVE-2024-23186 | Medium | 6.5 | 2024-05-06 | E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform mal… |
CVE-2024-23192 | Medium | 6.1 | 2024-04-08 | RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or succes… |
CVE-2024-23191 | Medium | 5.4 | 2024-04-08 | Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attack… |
CVE-2024-23190 | Medium | 5.4 | 2024-04-08 | Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would… |
CVE-2024-23189 | Medium | 5.4 | 2024-04-08 | Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker… |
CVE-2023-41708 | Medium | 5.4 | 2024-02-12 | References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safegua… |
CVE-2023-41707 | Medium | 6.5 | 2024-02-12 | Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41706 | Medium | 6.5 | 2024-02-12 | Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX Ap… |
CVE-2023-41705 | Medium | 6.5 | 2024-02-12 | Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41704 | High | 7.1 | 2024-02-12 | Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be inject… |
CVE-2023-41703 | Medium | 6.1 | 2024-02-12 | User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a maliciou… |
CVE-2023-41710 | Medium | 5.4 | 2024-01-08 | User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victi… |
CVE-2023-29052 | Medium | 5.4 | 2024-01-08 | Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure vict… |
CVE-2023-29051 | High | 8.1 | 2024-01-08 | User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default… |
CVE-2023-29050 | High | 7.6 | 2024-01-08 | The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hi… |
CVE-2023-29049 | Medium | 5.4 | 2024-01-08 | The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain t… |
CVE-2023-29048 | High | 8.8 | 2024-01-08 | A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users an… |