Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating

An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage…

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory

Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail

Very large headers can cause resource exhaustion when parsing message

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used…

None None None No publicly available exploits are known

When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users