Alerts This Week
Warning Icon 1 938
Alerts This Week
Warning Icon 1 938

Fedora 44 Dovecot Moderate Info Disclosure DoS Vuln 2026-96eeb03b88

fedora
Calendar Grey June 2, 2026
Dist Fedora Esm H88
CVE-2026-27851 and CVE-2026-33603 highlight Dovecot's vulnerabilities leading to information disclosure and DoS.
CVE-2026-27851: lib-var-expand: Safe filter marks all following pipelines safe

Summary

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security

primarily in mind. It also contains a small POP3 server. It supports mail

in either of maildir or mbox formats.

The SQL drivers and authentication plug-ins are in their subpackages.

Update Information:

CVE-2026-27851: lib-var-expand: Safe filter marks all following pipelines safe. CVE-2026-33603: auth: CRAM-SHA-*-PLUS channel binding could be faked. MITM attacker with a certificate trusted by the client could have bypassed the requirement for channel binding. CVE-2026-40020: IMAP folders can be shared-spammed to everyone. CVE-2026-42006: An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete. indexer-worker, quota-status, script-login, program-client-local: Root privileges are now dropped permanently before serving requests. indexer-worker: Default restart_request_count changed to 1 to work correctly after permanent root privilege drop. lmtp: Add back service_extra_groups=$SET:default_internal_group that was incorrectly removed in v2.4.3. master: inet_listener_reuse_port has been replaced by service_reuse_port. The new setting properly pre-creates all listener sockets at startup and ...

Topics%20covered

Topics Covered

security advisory denial of service fedora information disclosure Dovecot MITM attack

Change Log

* Fri May 15 2026 Michal Hlavinka - 1:2.4.4-1 - updated to 2.4.4 (#2476459)

References


[ 1 ] Bug #2479583 - CVE-2026-33603 dovecot: Dovecot: Information disclosure via SCRAM TLS channel binding bypass [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2479583 [ 2 ] Bug #2479588 - CVE-2026-40020 dovecot: dovecot: Denial of Service via IMAP SETACL command injection [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2479588 [ 3 ] Bug #2481123 - CVE-2026-40016 dovecot: Dovecot: Denial of Service due to Sieve script CPU limit bypass [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2481123

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-96eeb03b88' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
important
Lowest
Low
Medium
High
Critical

Name: dovecot
Product: Fedora 44
Version: 2.4.4
Release: 1.fc44
URL: https://www.dovecot.org/
Summary: Secure imap and pop3 server

Topics%20covered

Topics Covered

security advisory denial of service fedora information disclosure Dovecot MITM attack

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here