{
  "cveId": "CVE-2026-40015",
  "url": "https://patchblox.com/security/cve/CVE-2026-40015",
  "summary": "CVE-2026-40015 is fixed in 12 products on 1 platform, first by SUSE-SU-2026:23595-1, released September 1, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "dovecot: An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid comma...",
  "description": "An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. Disable IMAP hibernation. Update to non-vulnerable version. No publicly available exploits are known.",
  "published": "2026-08-28T12:16:28Z",
  "severity": "medium",
  "cvss": 4.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
  "epss": 0.00554,
  "epssPercentile": 0.46488,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "dovecot",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1:2.3.19.1\u002Bdfsg1-2.1\u002Bdeb12u7",
      "fix": "DEBIAN-CVE-2026-40015",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-40015",
      "released": "2026-09-10T12:12:19Z"
    },
    {
      "platform": "linux",
      "product": "dovecot",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:2.4.1\u002Bdfsg1-6\u002Bdeb13u7",
      "fix": "DEBIAN-CVE-2026-40015",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-40015",
      "released": "2026-09-10T12:12:19Z"
    },
    {
      "platform": "linux",
      "product": "dovecot",
      "release": "Debian 14",
      "fixedVersion": "1:2.4.5\u002Bdfsg1-1",
      "fix": "DEBIAN-CVE-2026-40015",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-40015",
      "released": "2026-09-10T12:12:19Z"
    },
    {
      "platform": "linux",
      "product": "dovecot",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot-debugsource",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot-devel",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot-mysql",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot-mysql-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot-pgsql",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot-pgsql-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot-pigeonhole",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot-pigeonhole-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1:2.4.5-1.fc43",
      "fix": "FEDORA-2026-E8A6485109",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109",
      "released": "2026-09-10T05:35:17Z"
    },
    {
      "platform": "linux",
      "product": "dovecot23",
      "release": "sles 15.6",
      "fixedVersion": "2.3.21.1-150200.76.1",
      "fix": "SUSE-SU-2026:4139-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4139-1",
      "released": "2026-09-14T07:22:32Z"
    },
    {
      "platform": "linux",
      "product": "dovecot23",
      "release": "sles 15.7",
      "fixedVersion": "2.3.21.1-150200.76.1",
      "fix": "SUSE-SU-2026:4139-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4139-1",
      "released": "2026-09-14T07:22:32Z"
    },
    {
      "platform": "linux",
      "product": "dovecot24",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.4.4-160000.2.1",
      "fix": "OPENSUSE-SU-2026:21720-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21720-1",
      "released": "2026-09-01T14:18:02Z"
    },
    {
      "platform": "linux",
      "product": "dovecot24",
      "release": "sles 16.0",
      "fixedVersion": "2.4.4-160000.2.1",
      "fix": "SUSE-SU-2026:23595-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23595-1",
      "released": "2026-09-01T14:12:16Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}