Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit

Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack

Dovecot OTP authentication is vulnerable to replay attack under specific conditions

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication

A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU

When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal…

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP

Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no

Dovecot has provided a script to use for attachment to text conversion