Security Advisories & Policy
Dovecot was designed since the beginning with security in mind and with many ways to provide privilege separation. Although the code is written with C, it’s a Dovecot-hardened special C variant that makes it much more difficult to write security holes than with most other C-based projects.
Found a Security Bug?
Do not report security issues via public mailing lists or public issues tracker. Please report vulnerabilities confidentially using our GPG encrypted mailbox at security@dovecot.org or via our YesWeHack Bug Bounty Program.
General Bug Reporting
For non-security related bugs, technical defects, or configuration issues, please consult the guidelines before submitting.
Dovecot Pro Security Advisories
Dovecot Pro is the commercial product and maintains its own security advisory program. Pro advisories may also be applicable to Dovecot Community Edition.
Security Advisories
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.
An attacker that has valid credentials can use IMAP LIST command to consume CPU.
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed.
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration.
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands.
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message.
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU.
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process.
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that fix.
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox.
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail.
acl: lda_mailbox_autocreate can bypass acl restrictions
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them.
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field.
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt.
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret.
Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed.
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client.
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do.
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash.
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately.
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections.
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped.
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection.
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit.
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users.
When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail.
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response.
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication.
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin.
A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "full_value" buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn't matter whether it's a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions.
Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue.
Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP.
Privilege escalation possible in dovecot when similar master and non-master passdbs are used
oauth2 JWT local validation path traversal
SMTP Submission service STARTTLS injection
IMAP hibernation allows accessing other peoples mail
MIME parsing crashes with particular messages
Receiving mail with deeply nested MIME parts leads to resource exhaustion
Specially crafted NTLM package can crash auth service
Specially crafted RPA authentication message crashes auth
Sending malformed NOOP command causes crash in submission, submission-login or lmtp service.
Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submission or lmtp service.
Sending mail with empty quoted localpart causes submission or lmtp component to crash.
Truncated UTF-8 can be used to DoS submission-login and lmtp processes
Specially crafted mail can crash snippet generation
IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings
Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting
Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent
JSON encoder in Dovecot 2.3 incorrectly assert-crashes when encountering invalid UTF-8 characters
Buffer overflow when reading extension header from dovecot index files
Suitable client certificate can be used to login as other user