# SUSE-SU-2026:4139-1: dovecot23 security update

SUSE-SU-2026:4139-1, released September 14, 2026, fixes 34 CVEs in dovecot23 (version 2.3.21.1-150200.76.1). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-4139-1
- Platform: Linux
- Released: Sep 14, 2026
- Priority: High (Closes CVE-2024-23185, high severity)
- CVEs: 34, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:4139-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [dovecot23](https://patchblox.com/security/data/product/linux/dovecot23.md) | sles 15.6 | 2.3.21.1-150200.76.1 |
| [dovecot23](https://patchblox.com/security/data/product/linux/dovecot23.md) | sles 15.7 | 2.3.21.1-150200.76.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2024-23185](https://patchblox.com/security/data/cve/CVE-2024-23185.md) | High | dovecot23: large headers can cause resource exhaustion when parsing message (bsc#1229183). | 7.5 | 0.0130 |  |
| [CVE-2026-27858](https://patchblox.com/security/data/cve/CVE-2026-27858.md) | High | dovecot23: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901). | 7.5 | 0.0080 |  |
| [CVE-2025-59032](https://patchblox.com/security/data/cve/CVE-2025-59032.md) | High | dovecot23: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902). | 7.5 | 0.0073 |  |
| [CVE-2026-27857](https://patchblox.com/security/data/cve/CVE-2026-27857.md) | High | dovecot23: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898). | 7.5 | 0.0068 |  |
| [CVE-2026-42006](https://patchblox.com/security/data/cve/CVE-2026-42006.md) | High | dovecot: An attacker can cause uncontrolled memory usage with excessive bracing over IMAP | 7.5 | 0.0062 |  |
| [CVE-2026-33263](https://patchblox.com/security/data/cve/CVE-2026-33263.md) | High | dovecot: When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic cause... | 9.1 | 0.0055 |  |
| [CVE-2025-59028](https://patchblox.com/security/data/cve/CVE-2025-59028.md) | High | dovecot23: Invalid base64 authentication can cause DoS for other logins (bsc#1260894). | 7.5 | 0.0046 |  |
| [CVE-2026-33605](https://patchblox.com/security/data/cve/CVE-2026-33605.md) | High | dovecot: An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authe... | 9.1 | 0.0045 |  |
| [CVE-2026-42391](https://patchblox.com/security/data/cve/CVE-2026-42391.md) | High | dovecot: An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, whi... | 9.1 | 0.0045 |  |
| [CVE-2026-27852](https://patchblox.com/security/data/cve/CVE-2026-27852.md) | High | dovecot23: DoS by sending mail with bad header (bsc#1276799). | 9.1 | 0.0043 |  |
| [CVE-2026-40019](https://patchblox.com/security/data/cve/CVE-2026-40019.md) | High | dovecot: An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spi... | 9.1 | 0.0037 |  |
| [CVE-2026-42007](https://patchblox.com/security/data/cve/CVE-2026-42007.md) | High | dovecot: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-fr... | 9.1 | 0.0035 |  |
| [CVE-2026-73208](https://patchblox.com/security/data/cve/CVE-2026-73208.md) | High | dovecot: An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token respon... | 9.1 | 0.0031 |  |
| [CVE-2024-23184](https://patchblox.com/security/data/cve/CVE-2024-23184.md) | Routine | dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU | 6.5 | 0.0085 |  |
| [CVE-2026-33607](https://patchblox.com/security/data/cve/CVE-2026-33607.md) | Routine | dovecot23: IMAP LIST match_sub() Exponential Backtracking -- CPU Denial of Service (bsc#1276795). | 4.3 | 0.0055 |  |
| [CVE-2026-40015](https://patchblox.com/security/data/cve/CVE-2026-40015.md) | Routine | dovecot23: imap-hibernate can be crashed (bsc#1276812). | 4.3 | 0.0055 |  |
| [CVE-2026-27856](https://patchblox.com/security/data/cve/CVE-2026-27856.md) | Routine | dovecot23: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899). | 5.9 | 0.0040 |  |
| [CVE-2026-52687](https://patchblox.com/security/data/cve/CVE-2026-52687.md) | Routine | dovecot23: IMAP: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837). | 6.5 | 0.0040 |  |
| [CVE-2026-73209](https://patchblox.com/security/data/cve/CVE-2026-73209.md) | Routine | dovecot23: imap-login crash: Self-recursion on zero-output decompress chunks (bsc#1276833). | 6.5 | 0.0040 |  |
| [CVE-2026-27859](https://patchblox.com/security/data/cve/CVE-2026-27859.md) | Routine | dovecot23: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897). | 5.3 | 0.0038 |  |
| [CVE-2026-42395](https://patchblox.com/security/data/cve/CVE-2026-42395.md) | Routine | dovecot23: Single NUL-Byte XCLIENT FORWARD Payload Crashes (bsc#1276826). | 4.3 | 0.0035 |  |
| [CVE-2026-40016](https://patchblox.com/security/data/cve/CVE-2026-40016.md) | Routine | dovecot23: Sieve :contains/:matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148). | 6.5 | 0.0034 |  |
| [CVE-2026-40014](https://patchblox.com/security/data/cve/CVE-2026-40014.md) | Routine | dovecot23: CPU DoS via Crafted References Header (bsc#1276804). | 6.5 | 0.0033 |  |
| [CVE-2026-27855](https://patchblox.com/security/data/cve/CVE-2026-27855.md) | Routine | dovecot23: OTP driver vulnerable to replay attack (bsc#1260900). | 5.9 | 0.0032 |  |
| [CVE-2026-33604](https://patchblox.com/security/data/cve/CVE-2026-33604.md) | Routine | dovecot23: SMTP Smuggling via Missing Dot-Stuffing (bsc#1276802). | 5.9 | 0.0031 |  |
| [CVE-2026-52681](https://patchblox.com/security/data/cve/CVE-2026-52681.md) | Routine | dovecot23: Sieve resource usage tracking lost when active script changes (bsc#1276828). | 3.1 | 0.0030 |  |
| [CVE-2025-59031](https://patchblox.com/security/data/cve/CVE-2025-59031.md) | Routine | dovecot23: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing | 4.3 | 0.0029 |  |
| [CVE-2026-40020](https://patchblox.com/security/data/cve/CVE-2026-40020.md) | Routine | dovecot23: IMAP folders can be shared-spammed to everyone (bsc#1265149). | 4.3 | 0.0026 |  |
| [CVE-2026-40203](https://patchblox.com/security/data/cve/CVE-2026-40203.md) | Routine | dovecot23: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text | 3.7 | 0.0026 |  |
| [CVE-2026-33606](https://patchblox.com/security/data/cve/CVE-2026-33606.md) | Routine | dovecot23: dsync: Mail content can cause dsync protocol injection (bsc#1276800). | 4.8 | 0.0025 |  |
| [CVE-2026-42008](https://patchblox.com/security/data/cve/CVE-2026-42008.md) | Routine | dovecot23: XCLIENT FORWARD= bare token not namespaced (bsc#1276824). | 4.3 | 0.0024 |  |
| [CVE-2026-33603](https://patchblox.com/security/data/cve/CVE-2026-33603.md) | Routine | dovecot23: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147). | 5.3 | 0.0021 |  |
| [CVE-2026-40205](https://patchblox.com/security/data/cve/CVE-2026-40205.md) | Routine | dovecot23: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820). | 5.9 | 0.0021 |  |
| [CVE-2026-42393](https://patchblox.com/security/data/cve/CVE-2026-42393.md) | Routine | dovecot23: doveadm_password or api key length can still be leaked with timing comparisons (bsc#1276827). | 3.1 | 0.0017 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.