dovecot - Debian Package Tracker

general

source: dovecot (main)
version: 1:2.4.3+dfsg1-2
maintainer: Dovecot Maintainers (DMD)
uploaders: Noah Meyerhans [DMD]
arch: any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:2.3.13+dfsg1-2+deb11u1
o-o-sec: 1:2.3.13+dfsg1-2+deb11u2
oldstable: 1:2.3.19.1+dfsg1-2.1+deb12u1
old-sec: 1:2.3.19.1+dfsg1-2.1+deb12u3
old-bpo: 1:2.3.21.1+dfsg1-1~bpo12+1
old-p-u: 1:2.3.19.1+dfsg1-2.1+deb12u3
stable: 1:2.4.1+dfsg1-6+deb13u3
stable-sec: 1:2.4.1+dfsg1-6+deb13u4
stable-p-u: 1:2.4.1+dfsg1-6+deb13u4
testing: 1:2.4.3+dfsg1-2
unstable: 1:2.4.3+dfsg1-2

versioned links

1:2.3.13+dfsg1-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.3.13+dfsg1-2+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.3.19.1+dfsg1-2.1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.3.19.1+dfsg1-2.1+deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.3.21.1+dfsg1-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.4.1+dfsg1-6+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.4.1+dfsg1-6+deb13u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.4.3+dfsg1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

dovecot-auth-lua (1 bugs: 0, 1, 0, 0)
dovecot-core (48 bugs: 0, 37, 11, 0)
dovecot-dev
dovecot-flatcurve
dovecot-gssapi
dovecot-imapd (15 bugs: 0, 15, 0, 0)
dovecot-ldap (1 bugs: 0, 0, 1, 0)
dovecot-lmtpd (2 bugs: 0, 1, 1, 0)
dovecot-managesieved
dovecot-mysql
dovecot-pgsql
dovecot-pop3d (1 bugs: 0, 1, 0, 0)
dovecot-sieve (10 bugs: 0, 8, 2, 0)
dovecot-solr
dovecot-sqlite
dovecot-submissiond

action needed

8 security issues in bullseye high

There are 8 open security issues in bullseye.

7 important issues:

CVE-2026-0394: When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. Upgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can also ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d. No publicly available exploits are known.
CVE-2025-59032: ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
CVE-2026-27855: Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM. No publicly available exploits are known.
CVE-2026-27856: Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.
CVE-2026-27857: Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Install fixed version, there is no other remediation. No publicly available exploits are known.
CVE-2026-27858: Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
CVE-2026-27859: A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. Use MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the processing is limited. No publicly available exploits are known.

1 issue postponed or untriaged:

CVE-2020-28200: (postponed; to be fixed through a stable update) The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.

Created: 2026-03-27 Last update: 2026-04-28 19:02

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-04-17 Last update: 2026-04-29 12:30

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-04-06 Last update: 2026-04-29 11:30

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit e6a3027b1ad1f3d138aed820965343658b76c4af
Merge: 5420710 6261bfd
Author: Noah Meyerhans <noahm@debian.org>
Date:   Wed Apr 22 14:48:47 2026 +0000

    Merge branch 'sysusers' into 'master'
    
    Install and use sysusers.d config file
    
    See merge request debian/dovecot!49

commit 6261bfd9d52087cb19cc8b3189f98cc5705fc6e3
Author: Luca Boccassi <luca.boccassi@gmail.com>
Date:   Mon Apr 20 23:20:17 2026 +0100

    Install and use sysusers.d config file
    
    Use systemd-sysusers to create the dovecot and dovenull system
    users and groups. Drop the adduser dependency and the manual
    adduser calls from postinst, replacing them with a systemd-sysusers
    call so the users are created before the chgrp that follows.
    
    Drop the userdel calls from postrm, as removing system users and
    groups on purge is considered bad practice since the uid/gid may
    be recycled.

Created: 2026-04-22 Last update: 2026-04-27 15:31

2 open merge requests in Salsa normal

There are 2 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2025-08-19 Last update: 2026-04-03 19:02

debian/patches: 5 patches to forward upstream low

Among the 7 debian patches available in version 1:2.4.3+dfsg1-2 of the package, we noticed the following issues:

5 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-04-15 09:32

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-04-15 04:31

testing migrations

This package is part of the ongoing testing transition known as auto-libsodium. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-xapian-core transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-04-25] Accepted dovecot 1:2.3.19.1+dfsg1-2.1+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Noah Meyerhans)
[2026-04-17] dovecot 1:2.4.3+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2026-04-14] Accepted dovecot 1:2.4.3+dfsg1-2 (source) into unstable (Noah Meyerhans)
[2026-04-06] Accepted dovecot 1:2.3.19.1+dfsg1-2.1+deb12u3 (source) into oldstable-security (Debian FTP Masters) (signed by: Noah Meyerhans)
[2026-04-06] Accepted dovecot 1:2.3.19.1+dfsg1-2.1+deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Noah Meyerhans)
[2026-04-06] Accepted dovecot 1:2.4.1+dfsg1-6+deb13u4 (source) into proposed-updates (Debian FTP Masters) (signed by: Noah Meyerhans)
[2026-04-05] Accepted dovecot 1:2.3.19.1+dfsg1-2.1+deb12u2 (source) into oldstable-security (Debian FTP Masters) (signed by: Noah Meyerhans)
[2026-04-05] Accepted dovecot 1:2.4.1+dfsg1-6+deb13u4 (source) into stable-security (Debian FTP Masters) (signed by: Noah Meyerhans)
[2026-04-03] Accepted dovecot 1:2.4.3+dfsg1-1 (source) into unstable (Noah Meyerhans)
[2026-03-08] dovecot 1:2.4.2+dfsg1-4 MIGRATED to testing (Debian testing watch)
[2026-03-07] Accepted dovecot 1:2.4.1+dfsg1-6+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Noah Meyerhans)
[2026-03-05] Accepted dovecot 1:2.4.2+dfsg1-4 (source) into unstable (Noah Meyerhans)
[2026-02-07] dovecot 1:2.4.2+dfsg1-3 MIGRATED to testing (Debian testing watch)
[2026-02-04] Accepted dovecot 1:2.4.2+dfsg1-3 (source) into unstable (Noah Meyerhans)
[2025-12-07] dovecot 1:2.4.2+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2025-11-26] Accepted dovecot 1:2.4.2+dfsg1-2 (source) into unstable (Noah Meyerhans)
[2025-11-13] Accepted dovecot 1:2.4.2+dfsg1-1 (source) into unstable (Noah Meyerhans)
[2025-11-01] Accepted dovecot 1:2.4.1+dfsg1-6+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Noah Meyerhans)
[2025-10-13] Accepted dovecot 1:2.4.1+dfsg1-6+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Noah Meyerhans)
[2025-10-05] Accepted dovecot 1:2.4.1+dfsg1-6+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Noah Meyerhans)
[2025-10-04] dovecot 1:2.4.1+dfsg1-9 MIGRATED to testing (Debian testing watch)
[2025-09-30] Accepted dovecot 1:2.4.1+dfsg1-9 (source) into unstable (Noah Meyerhans)
[2025-09-30] Accepted dovecot 1:2.4.1+dfsg1-8 (source) into unstable (Noah Meyerhans)
[2025-09-22] Accepted dovecot 1:2.4.1+dfsg1-7 (source) into unstable (Noah Meyerhans)
[2025-07-09] dovecot 1:2.4.1+dfsg1-6 MIGRATED to testing (Debian testing watch)
[2025-06-18] Accepted dovecot 1:2.4.1+dfsg1-6 (source) into unstable (Noah Meyerhans)
[2025-06-18] dovecot 1:2.4.1+dfsg1-5 MIGRATED to testing (Debian testing watch)
[2025-06-10] Accepted dovecot 1:2.4.1+dfsg1-6~exp1 (source) into experimental (Noah Meyerhans)
[2025-05-28] Accepted dovecot 1:2.4.1+dfsg1-5 (source) into unstable (Noah Meyerhans)
[2025-05-18] dovecot 1:2.4.1+dfsg1-4 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 89 92
RC: 0
I&N: 72 75
M&W: 16
F&P: 1
patch: 1

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:2.4.2+dfsg1-3ubuntu2
6 bugs
patches for 1:2.4.2+dfsg1-3ubuntu2