When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the…

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret

None None None No publicly available exploits are known