# FEDORA-2026-E8A6485109: Security update for 10 packages FEDORA-2026-E8A6485109, released September 10, 2026, fixes 17 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/fedora-2026-e8a6485109 - Platform: Linux - Released: Sep 10, 2026 - Priority: High (Closes CVE-2026-33263, high severity) - CVEs: 17, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://bodhi.fedoraproject.org/updates/FEDORA-2026-e8a6485109 ## Applies to | Product | Release | Fixed in | |---|---|---| | [dovecot](https://patchblox.com/security/data/product/linux/dovecot.md) | Fedora 43 | 1:2.4.5-1.fc43 | | [dovecot-debuginfo](https://patchblox.com/security/data/product/linux/dovecot-debuginfo.md) | Fedora 43 | 1:2.4.5-1.fc43 | | [dovecot-debugsource](https://patchblox.com/security/data/product/linux/dovecot-debugsource.md) | Fedora 43 | 1:2.4.5-1.fc43 | | [dovecot-devel](https://patchblox.com/security/data/product/linux/dovecot-devel.md) | Fedora 43 | 1:2.4.5-1.fc43 | | [dovecot-mysql](https://patchblox.com/security/data/product/linux/dovecot-mysql.md) | Fedora 43 | 1:2.4.5-1.fc43 | | [dovecot-mysql-debuginfo](https://patchblox.com/security/data/product/linux/dovecot-mysql-debuginfo.md) | Fedora 43 | 1:2.4.5-1.fc43 | | [dovecot-pgsql](https://patchblox.com/security/data/product/linux/dovecot-pgsql.md) | Fedora 43 | 1:2.4.5-1.fc43 | | [dovecot-pgsql-debuginfo](https://patchblox.com/security/data/product/linux/dovecot-pgsql-debuginfo.md) | Fedora 43 | 1:2.4.5-1.fc43 | | [dovecot-pigeonhole](https://patchblox.com/security/data/product/linux/dovecot-pigeonhole.md) | Fedora 43 | 1:2.4.5-1.fc43 | | [dovecot-pigeonhole-debuginfo](https://patchblox.com/security/data/product/linux/dovecot-pigeonhole-debuginfo.md) | Fedora 43 | 1:2.4.5-1.fc43 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-33263](https://patchblox.com/security/data/cve/CVE-2026-33263.md) | High | dovecot: When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic cause... | 9.1 | 0.0055 | | | [CVE-2026-33605](https://patchblox.com/security/data/cve/CVE-2026-33605.md) | High | dovecot: An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authe... | 9.1 | 0.0045 | | | [CVE-2026-27852](https://patchblox.com/security/data/cve/CVE-2026-27852.md) | High | dovecot: Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind | 9.1 | 0.0043 | | | [CVE-2026-40019](https://patchblox.com/security/data/cve/CVE-2026-40019.md) | High | dovecot: An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spi... | 9.1 | 0.0037 | | | [CVE-2026-42007](https://patchblox.com/security/data/cve/CVE-2026-42007.md) | High | dovecot: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-fr... | 9.1 | 0.0035 | | | [CVE-2026-40018](https://patchblox.com/security/data/cve/CVE-2026-40018.md) | High | dovecot: None None None No publicly available exploits are known. | 9.1 | 0.0032 | | | [CVE-2026-40013](https://patchblox.com/security/data/cve/CVE-2026-40013.md) | Routine | dovecot: An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes... | 4.3 | 0.0087 | | | [CVE-2026-33607](https://patchblox.com/security/data/cve/CVE-2026-33607.md) | Routine | dovecot: An attacker that has valid credentials can use IMAP LIST command to consume CPU | 4.3 | 0.0055 | | | [CVE-2026-40015](https://patchblox.com/security/data/cve/CVE-2026-40015.md) | Routine | dovecot: An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid comma... | 4.3 | 0.0055 | | | [CVE-2026-40014](https://patchblox.com/security/data/cve/CVE-2026-40014.md) | Routine | dovecot: An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU di... | 6.5 | 0.0033 | | | [CVE-2026-40017](https://patchblox.com/security/data/cve/CVE-2026-40017.md) | Routine | dovecot: An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal... | 6.5 | 0.0033 | | | [CVE-2026-33604](https://patchblox.com/security/data/cve/CVE-2026-33604.md) | Routine | dovecot: An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use... | 5.9 | 0.0031 | | | [CVE-2026-40203](https://patchblox.com/security/data/cve/CVE-2026-40203.md) | Routine | dovecot: When IMAP compression is enabled, the same compression state is reused across responses in a session, so response siz... | 3.7 | 0.0026 | | | [CVE-2026-33606](https://patchblox.com/security/data/cve/CVE-2026-33606.md) | Routine | dovecot: Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrat... | 4.8 | 0.0025 | | | [CVE-2026-42008](https://patchblox.com/security/data/cve/CVE-2026-42008.md) | Routine | dovecot: Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authent... | 4.3 | 0.0024 | | | [CVE-2026-40205](https://patchblox.com/security/data/cve/CVE-2026-40205.md) | Routine | dovecot: An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more... | 5.9 | 0.0021 | | | [CVE-2026-40204](https://patchblox.com/security/data/cve/CVE-2026-40204.md) | Routine | dovecot: None None None No publicly available exploits are known. | 3.1 | 0.0021 | | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo