DO
Product
Dovecot
16
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 10Low 0
Watch
Add Dovecot to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24031 | 8.2 | Mar 27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin Affected: before 3.1.4 |
| CVE-2026-27858 | 7.5 | Mar 27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory Affected: before 2.3.22.1; 3.0.0 before 3.0.5; 3.1.0 before 3.1.4 |
| CVE-2026-27857 | 7.5 | Mar 27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage Affected: before 2.3.22.1; 3.0.0 before 3.0.5; 3.1.0 before 3.1.4 |
| CVE-2025-59032 | 7.5 | Mar 27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response Affected: before 3.1.3 |
| CVE-2025-59028 | 7.5 | Mar 27 | When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail Affected: before 3.1.2 |
Showing 5