CVE-2026-42006 | Medium | 4.3 | 2026-05-12 | An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this… |
CVE-2026-40020 | Low | 3.1 | 2026-05-12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be… |
CVE-2026-40016 | Medium | 5.3 | 2026-05-12 | Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the config… |
CVE-2026-33603 | Medium | 6.8 | 2026-05-12 | Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to p… |
CVE-2026-27851 | High | 7.4 | 2026-05-12 | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to b… |
CVE-2026-27860 | Low | 3.7 | 2026-03-27 | If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restricti… |
CVE-2026-27859 | Medium | 5.3 | 2026-03-27 | A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message causes mail delivery… |
CVE-2026-27858 | High | 7.5 | 2026-03-27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
Attacker can force manages… |
CVE-2026-27857 | Medium | 4.3 | 2026-03-27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This… |
CVE-2026-27856 | High | 7.4 | 2026-03-27 | Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured cre… |
CVE-2026-27855 | Medium | 6.8 | 2026-03-27 | Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP cred… |
CVE-2026-24031 | High | 7.7 | 2026-03-27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user… |
CVE-2026-0394 | Medium | 5.3 | 2026-03-27 | When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characte… |
CVE-2025-59032 | High | 7.5 | 2026-03-27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unava… |
CVE-2025-59031 | Medium | 4.3 | 2026-03-27 | Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted… |
CVE-2025-59028 | Medium | 5.3 | 2026-03-27 | When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 d… |
CVE-2025-59026 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-59025 | Medium | 6.1 | 2025-11-27 | Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of… |
CVE-2025-30190 | Medium | 5.4 | 2025-11-27 | Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users… |
CVE-2025-30186 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-30191 | Medium | 5.4 | 2025-10-31 | Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information t… |
CVE-2025-30189 | High | 7.4 | 2025-10-31 | When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users… |
CVE-2025-30188 | High | 7.5 | 2025-10-31 | Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the w… |
CVE-2024-23185 | High | 7.5 | 2024-09-10 | Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when… |
CVE-2024-23184 | Medium | 5.0 | 2024-09-10 | Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, a… |
CVE-2024-25584 | Medium | 5.3 | 2024-09-06 | Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail… |
CVE-2024-25582 | Medium | 5.4 | 2024-08-19 | Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or e… |
CVE-2024-23193 | Medium | 5.3 | 2024-05-06 | E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node… |
CVE-2024-23188 | Medium | 6.5 | 2024-05-06 | Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interacti… |
CVE-2024-23187 | Medium | 6.5 | 2024-05-06 | Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perfor… |
CVE-2024-23186 | Medium | 6.5 | 2024-05-06 | E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform mal… |
CVE-2024-23192 | Medium | 6.1 | 2024-04-08 | RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or succes… |
CVE-2024-23191 | Medium | 5.4 | 2024-04-08 | Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attack… |
CVE-2024-23190 | Medium | 5.4 | 2024-04-08 | Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would… |
CVE-2024-23189 | Medium | 5.4 | 2024-04-08 | Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker… |
CVE-2023-41708 | Medium | 5.4 | 2024-02-12 | References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safegua… |
CVE-2023-41707 | Medium | 6.5 | 2024-02-12 | Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41706 | Medium | 6.5 | 2024-02-12 | Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX Ap… |
CVE-2023-41705 | Medium | 6.5 | 2024-02-12 | Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41704 | High | 7.1 | 2024-02-12 | Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be inject… |
CVE-2023-41703 | Medium | 6.1 | 2024-02-12 | User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a maliciou… |
CVE-2023-41710 | Medium | 5.4 | 2024-01-08 | User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victi… |
CVE-2023-29052 | Medium | 5.4 | 2024-01-08 | Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure vict… |
CVE-2023-29051 | High | 8.1 | 2024-01-08 | User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default… |
CVE-2023-29050 | High | 7.6 | 2024-01-08 | The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hi… |
CVE-2023-29049 | Medium | 5.4 | 2024-01-08 | The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain t… |
CVE-2023-29048 | High | 8.8 | 2024-01-08 | A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users an… |