-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 27 Sep 2026 04:43:05 +0200 Source: dovecot Architecture: source Version: 1:2.3.19.1+dfsg1-2.1+deb12u7 Distribution: bookworm-security Urgency: high Maintainer: Dovecot Maintainers <dovecot@packages.debian.org> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1146018 Changes: dovecot (1:2.3.19.1+dfsg1-2.1+deb12u7) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * Backport upstream security fixes from v2.4.5 (closes: #1146018): + Fix CVE-2026-27852: DoS by sending mail with bad header. + Fix CVE-2026-33263: submission-login crash when mail_max_userip_connections is reached. + Fix CVE-2026-33604: SMTP Smuggling via missing dot-stuffing after bare carriage return. + Fix CVE-2026-33605: managesieve-login crash via crafted command before authenticating. + Fix CVE-2026-33606: dsync protocol injection vulnerability via crafted user mail content. + Mitigate CVE-2026-33607: CPU denial of service via IMAP LIST match_sub() exponential backtracking. The mitification adds a hardcoded limit of 20000 and returns IMAP_MATCH_NO when exceding it. + Fix CVE-2026-40013 [pigeonhole]: Stack buffer underflow in managesieve CHECKSCRIPT and PUTSCRIPT commands. + Fix CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via crafted references header. + Fix CVE-2026-40015: imap-hibernate crash via crafted commands. + Fix CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 hash collision in strmap. The fix introduces a new keyed xxh64 strmap on-disk format v2. strmap files using the old format are automatically upgraded, so they cannot be read by an older dovecot version. + Fix CVE-2026-40018: SQL injection vulnerability via multi-byte escaping. + Fix CVE-2026-40203: IMAP COMPRESS information disclosure via CRIME-style cross-command compression oracle attacks. The DEFLATE compression dictionary is now reset via Z_FULL_FLUSH after each tagged response line. + Fix CVE-2026-40204: ACL restriction bypass via lda_mailbox_autocreate(). + Fix CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path. + Fix CVE-2026-42007 [pigeonhole]: Sieve editheader RCE via use-after-free in the mail editing code. + Fix CVE-2026-42008: nopassword injection via trusted proxy due to missing namespace in XCLIENT FORWARD= bare tokens. + Fix CVE-2026-42391: Denial of service via IMAP ID command with a a very large number of parameters before logging in. + Fix CVE-2026-42393: doveadm_password or api key length can be leaked via timing attacks. + Fix CVE-2026-42394 [pigeonhole]: Arbitrary file disclosure due to symlink traversal flaw. + Fix CVE-2026-42395: login process crash via NUL-Byte XCLIENT FORWARD payload. + Fix CVE-2026-52681 [pigeonhole]: Denial of service via CPU resource usage bypass caused by repeatedly changing the active script. The cumulative CPU tracking is now tracken a a per-user sieve-rusage file rather than in each compiled Sieve binary's (.svbin) header. + Fix CVE-2026-52687: Denial of service via invalid IMAP COMPRESS algorithm. + Fix CVE-2026-73208: The "aud" claim is used as fallback for missing scope claim. + Fix CVE-2026-73209: imap-login crash due to self-recursion on zero-output decompress chunks. Checksums-Sha1: a0fc34a28f641b92eec7337e3d0eb182e98b379c 4216 dovecot_2.3.19.1+dfsg1-2.1+deb12u7.dsc 30481c1f0bfa2d9c912335c67d856f46c030538f 181480 dovecot_2.3.19.1+dfsg1-2.1+deb12u7.debian.tar.xz a71f8817144bd8f574337878d983b31df693dda3 6614 dovecot_2.3.19.1+dfsg1-2.1+deb12u7_source.buildinfo Checksums-Sha256: 69ca70a960a60960a9d7c0c7889e64a4f1e833285658852545048707a6a88d84 4216 dovecot_2.3.19.1+dfsg1-2.1+deb12u7.dsc 442f53ab1fcd596a016b2a5a81886a49d0fe30186f9928b09c047103209f9946 181480 dovecot_2.3.19.1+dfsg1-2.1+deb12u7.debian.tar.xz 474ce0cf6d6171bfe5cfbf7da4542ca71bcc07dc424e9d5925c3956be985fd7a 6614 dovecot_2.3.19.1+dfsg1-2.1+deb12u7_source.buildinfo Files: 1df697876cea462941ded2d689d3dd54 4216 mail optional dovecot_2.3.19.1+dfsg1-2.1+deb12u7.dsc 4ba07a1515f241f211c41e87b44e34de 181480 mail optional dovecot_2.3.19.1+dfsg1-2.1+deb12u7.debian.tar.xz 30c63c3cff5b1a7e83e3e2744a8440a5 6614 mail optional dovecot_2.3.19.1+dfsg1-2.1+deb12u7_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrl4gQACgkQ05pJnDwh pVK8gw//cXJHsZHTgRND+rLRAOAWnx0v9F+cqYr30PfLS1jKqOf/CwcfM79sjpLw as8K0FUrbd02lBdHeTbZMiN35MTbvpIN+5MCZYbOQQRwqZhwC3RYIUkQ/sa+0St6 rHPkKHJXadzij07oS7ni8AJA5xjIAz3TdVn7I0USTQbRFvSeCyA0ch1AXnOZNLBW 3bb3v6xumZNJeiV8rem3bgqPTS+czsAV/xUD21HQIxx2cyGUVo+fEXLNwPODJB+Q f49/op/npbyEkW163ESvNos0ryInALWb8/PdcMy0OQ88l9NtWR3f/Setyas3SXYg F6AjlcDOb9/ZRe2FJuwaB9gYoc5qO541kX860HuNQP5mSBWuZEghOe6IVqfUkBG6 Z625gFM49nOVs9dXCCWOZVIe1Xz4o9DM6YSKOu/N+YvSNpTHWhEFsQ2N3E/6nDtu X/2K/JhAY5b0418eSMlj/JNov8VBmspmvO0XaVdyOiUWuOlzWZMTZoVQQkCCleXW Kop1wz+/w9ACNeM9bjlwWtcNBT4hnTy1gW2i3D+YIToE6t+hUDXfKdZ1t0Kmie3h rD3Nzqs1jq1/G9DF2qfIefI3KsPRT5IZARXklWGnM35imm2Yi6H1nsZFMCF2O0ty d67E7hUJmjvWUL5BK0DO5nKnjEvTtBZBeIdPl183QFHAuEMpD9k= =UnmH -----END PGP SIGNATURE-----
