DO
Product
Dovecot
69
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 20Medium 23Low 1
Watch
Add Dovecot to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-30550 | 8.8 | Jul 17 | An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20 Affected: 2.3 before 2.4.0; 2.2 |
| CVE-2026-24031 | 8.2 | Mar 27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin Affected: before 2.4.3 |
| CVE-2019-7524 | 7.8 | Mar 28 | In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root Affected: before 2.2.36.3; 2.3.0 before 2.3.5.1 |
| CVE-2026-27858 | 7.5 | Mar 27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory Affected: before 2.4.3 |
| CVE-2026-27857 | 7.5 | Mar 27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage Affected: before 2.4.3 |
| CVE-2025-59032 | 7.5 | Mar 27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response Affected: before 2.4.3 |
| CVE-2025-59028 | 7.5 | Mar 27 | When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail Affected: before 2.4.3 |
| CVE-2020-25275 | 7.5 | Jan 4 | Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME… Affected: before 2.3.13 |
| CVE-2020-12674 | 7.5 | Aug 12 | In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled Affected: before 2.3.11.3 |
| CVE-2020-12673 | 7.5 | Aug 12 | In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read Affected: before 2.3.11.3 |
| CVE-2020-12100 | 7.5 | Aug 12 | In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail… Affected: before 2.3.11.3 |
| CVE-2020-10957 | 7.5 | May 18 | In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp Affected: before 2.3.10.1 |
| CVE-2020-7046 | 7.5 | Feb 12 | lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a… Affected: 2.3.9 before 2.3.9.3 |
| CVE-2019-11494 | 7.5 | May 8 | In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command Affected: 2.3.3 through 2.3.5.2 |
| CVE-2019-11499 | 7.5 | May 8 | In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable… Affected: 2.3.3 through 2.3.5.2 |
| CVE-2019-10691 | 7.5 | Apr 24 | The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the… Affected: before 2.3.5.2 |
| CVE-2017-2669 | 7.5 | Jun 21 | Dovecot before version 2.2.29 is vulnerable to a denial of service Affected: 2.2.26 through 2.2.28 |
| CVE-2017-15132 | 7.5 | Jan 25 | A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0 Affected: 2.0.0 through 2.2.33; 2.3.0 |
| CVE-2008-4577 | 7.5 | Oct 15 | The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions Affected: before 1.1.4 |
| CVE-2017-14461 | 7.1 | Mar 2 | A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial… Affected: 2.2.33.2 |
Showing 20