DO
Vendor
Dovecot
70
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42006 | DO Dovecot Dovecot | 4.3 | May 12 | An attacker can cause uncontrolled memory usage with excessive bracing over IMAP |
| CVE-2026-40020 | DO Dovecot Dovecot | 4.3 | May 12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no |
| CVE-2026-40016 | DO Dovecot Dovecot | 6.5 | May 12 | Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit |
| CVE-2026-33603 | DO Dovecot Dovecot | 5.3 | May 12 | Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding |
| CVE-2026-27851 | DO Dovecot Dovecot | 9.1 | May 12 | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped |
| CVE-2026-27860 | DO Dovecot Dovecot | 5.3 | Mar 27 | If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication |
| CVE-2026-27859 | DO Dovecot Dovecot | 5.3 | Mar 27 | A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU |
| CVE-2026-27858 | DO Dovecot Dovecot | 7.5 | Mar 27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory |
| CVE-2026-27857 | DO Dovecot Dovecot | 7.5 | Mar 27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage |
| CVE-2026-27856 | DO Dovecot Dovecot | 5.9 | Mar 27 | Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack |
| CVE-2026-27855 | DO Dovecot Dovecot | 5.9 | Mar 27 | Dovecot OTP authentication is vulnerable to replay attack under specific conditions |
| CVE-2026-24031 | DO Dovecot Dovecot | 8.2 | Mar 27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin |
| CVE-2026-0394 | DO Dovecot Dovecot | 5.3 | Mar 27 | When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal… |
| CVE-2025-59032 | DO Dovecot Dovecot | 7.5 | Mar 27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response |
| CVE-2025-59031 | DO Dovecot Dovecot | 4.3 | Mar 27 | Dovecot has provided a script to use for attachment to text conversion |
| CVE-2025-59028 | DO Dovecot Dovecot | 7.5 | Mar 27 | When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail |
| CVE-2022-30550 | DO Dovecot Dovecot | 8.8 | Jul 17 | An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20 |
| CVE-2021-33515 | DO Dovecot Dovecot | 4.8 | Jun 28 | The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp |
| CVE-2020-28200 | DO Dovecot Dovecot | 4.3 | Jun 28 | The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension |
| CVE-2021-29157 | DO Dovecot Dovecot | 5.5 | Jun 28 | Dovecot before 2.3.15 allows ../ Path Traversal |
| CVE-2020-25275 | DO Dovecot Dovecot | 7.5 | Jan 4 | Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME… |
| CVE-2020-24386 | DO Dovecot Dovecot | 6.8 | Jan 4 | An issue was discovered in Dovecot before 2.3.13 |
| CVE-2020-12674 | DO Dovecot Dovecot | 7.5 | Aug 12 | In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled |
| CVE-2020-12673 | DO Dovecot Dovecot | 7.5 | Aug 12 | In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read |
| CVE-2020-12100 | DO Dovecot Dovecot | 7.5 | Aug 12 | In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail… |
| CVE-2020-10967 | DO Dovecot Dovecot | 5.3 | May 18 | In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart |
| CVE-2020-10958 | DO Dovecot Dovecot | 5.3 | May 18 | In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under… |
| CVE-2020-10957 | DO Dovecot Dovecot | 7.5 | May 18 | In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp |
| CVE-2020-7957 | DO Dovecot Dovecot | 5.3 | Feb 12 | The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character… |
| CVE-2020-7046 | DO Dovecot Dovecot | 7.5 | Feb 12 | lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a… |
| CVE-2019-19722 | DO Dovecot Dovecot | 5.3 | Dec 13 | In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer Dereference |
| CVE-2016-4983 | DO Dovecot Dovecot | 3.3 | Nov 5 | A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files |
| CVE-2019-11500 | DO Dovecot Dovecot | 9.8 | Aug 29 | In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings |
| CVE-2019-11494 | DO Dovecot Dovecot | 7.5 | May 8 | In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command |
| CVE-2019-11499 | DO Dovecot Dovecot | 7.5 | May 8 | In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable… |
| CVE-2019-10691 | DO Dovecot Dovecot | 7.5 | Apr 24 | The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the… |
| CVE-2019-7524 | DO Dovecot Dovecot | 7.8 | Mar 28 | In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root |
| CVE-2019-3814 | DO Dovecot Dovecot | 6.8 | Mar 27 | It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates |
| CVE-2017-2669 | DO Dovecot Dovecot | 7.5 | Jun 21 | Dovecot before version 2.2.29 is vulnerable to a denial of service |
| CVE-2017-15130 | DO Dovecot Dovecot | 5.9 | Mar 2 | A denial of service flaw was found in dovecot before 2.2.34 |
| CVE-2017-14461 | DO Dovecot Dovecot | 7.1 | Mar 2 | A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial… |
| CVE-2017-15132 | DO Dovecot Dovecot | 7.5 | Jan 25 | A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0 |
| CVE-2015-3420 | DO Dovecot Dovecot | 5.9 | Sep 19 | The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to… |
| CVE-2016-8652 | DO Dovecot Dovecot | 5.9 | Feb 17 | The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without… |
| CVE-2013-2111 | DO Dovecot Dovecot | – | May 27 | The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via invalid APPEND parameters |
| CVE-2014-3430 | DO Dovecot Dovecot | – | May 14 | Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of… |
| CVE-2013-6171 | DO Dovecot Dovecot | – | Dec 9 | checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email… |
| CVE-2011-4318 | DO Dovecot Dovecot | – | Mar 7 | Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name… |
| CVE-2011-2167 | DO Dovecot Dovecot | – | May 24 | script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks… |
| CVE-2011-2166 | DO Dovecot Dovecot | – | May 24 | script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access… |
| CVE-2011-1929 | DO Dovecot Dovecot | – | May 24 | lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to… |
| CVE-2010-3780 | DO Dovecot Dovecot | – | Oct 6 | Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3… |
| CVE-2010-3779 | DO Dovecot Dovecot | – | Oct 6 | Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated… |
| CVE-2010-3707 | DO Dovecot Dovecot | – | Oct 6 | plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL… |
| CVE-2010-3706 | DO Dovecot Dovecot | – | Oct 6 | plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL… |
| CVE-2010-3304 | DO Dovecot Dovecot | – | Sep 24 | The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that… |
| CVE-2010-0745 | DO Dovecot Dovecot | – | May 20 | Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message |
| CVE-2009-3897 | DO Dovecot Dovecot | 5.5 | Nov 24 | Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by… |
| CVE-2009-3235 | DO Dovecot Dovecot | – | Sep 17 | Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to… |
| CVE-2008-5301 | DO Dovecot Dovecot | – | Dec 1 | Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".."… |