Linux · Security advisory · October 8, 2026
ELSA-2026-79371: Security update for 5 packages
ELSA-2026-79371, released October 8, 2026, fixes 8 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0055
46th percentile
Priority of the 8 CVEs
Patch now 0
Urgent 0
High 8
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| dovecot | ol 10 | 1:2.3.21-19.el10_2.8 |
| dovecot-devel | ol 10 | 1:2.3.21-19.el10_2.8 |
| dovecot-mysql | ol 10 | 1:2.3.21-19.el10_2.8 |
| dovecot-pgsql | ol 10 | 1:2.3.21-19.el10_2.8 |
| dovecot-pigeonhole | ol 10 | 1:2.3.21-19.el10_2.8 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-33263 | dovecot: When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic cause... | 9.1 | 0.0055 | None reported | |
| High | CVE-2026-33605 | dovecot: An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authe... | 9.1 | 0.0045 | None reported | |
| High | CVE-2026-42391 | dovecot: An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, whi... | 9.1 | 0.0045 | None reported | |
| High | CVE-2026-27852 | dovecot: Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind | 9.1 | 0.0043 | None reported | |
| High | CVE-2026-40019 | dovecot: An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spi... | 9.1 | 0.0037 | None reported | |
| High | CVE-2026-42007 | dovecot: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-fr... | 9.1 | 0.0035 | None reported | |
| High | CVE-2026-40018 | dovecot: None None None No publicly available exploits are known. | 9.1 | 0.0032 | None reported | |
| High | CVE-2026-73208 | dovecot: An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token respon... | 9.1 | 0.0031 | None reported |
Showing 1 to 8 of 8
1