Linux · Security advisory · September 10, 2026

FEDORA-2026-E8A6485109: Security update for 10 packages

FEDORA-2026-E8A6485109, released September 10, 2026, fixes 17 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
17
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0087
58th percentile

Priority of the 17 CVEs

Patch now 0 Urgent 0 High 6 Routine 11

Fixed package versions

ProductReleaseFixed in
dovecotFedora 431:2.4.5-1.fc43
dovecot-debuginfoFedora 431:2.4.5-1.fc43
dovecot-debugsourceFedora 431:2.4.5-1.fc43
dovecot-develFedora 431:2.4.5-1.fc43
dovecot-mysqlFedora 431:2.4.5-1.fc43
dovecot-mysql-debuginfoFedora 431:2.4.5-1.fc43
dovecot-pgsqlFedora 431:2.4.5-1.fc43
dovecot-pgsql-debuginfoFedora 431:2.4.5-1.fc43
dovecot-pigeonholeFedora 431:2.4.5-1.fc43
dovecot-pigeonhole-debuginfoFedora 431:2.4.5-1.fc43

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-33263 dovecot: When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic cause... 9.1 0.0055 None reported
High CVE-2026-33605 dovecot: An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authe... 9.1 0.0045 None reported
High CVE-2026-27852 dovecot: Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind 9.1 0.0043 None reported
High CVE-2026-40019 dovecot: An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spi... 9.1 0.0037 None reported
High CVE-2026-42007 dovecot: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-fr... 9.1 0.0035 None reported
High CVE-2026-40018 dovecot: None None None No publicly available exploits are known. 9.1 0.0032 None reported
Routine CVE-2026-40013 dovecot: An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes... 4.3 0.0087 None reported
Routine CVE-2026-33607 dovecot: An attacker that has valid credentials can use IMAP LIST command to consume CPU 4.3 0.0055 None reported
Routine CVE-2026-40015 dovecot: An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid comma... 4.3 0.0055 None reported
Routine CVE-2026-40014 dovecot: An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU di... 6.5 0.0033 None reported
Routine CVE-2026-40017 dovecot: An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal... 6.5 0.0033 None reported
Routine CVE-2026-33604 dovecot: An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use... 5.9 0.0031 None reported
Routine CVE-2026-40203 dovecot: When IMAP compression is enabled, the same compression state is reused across responses in a session, so response siz... 3.7 0.0026 None reported
Routine CVE-2026-33606 dovecot: Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrat... 4.8 0.0025 None reported
Routine CVE-2026-42008 dovecot: Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authent... 4.3 0.0024 None reported
Routine CVE-2026-40205 dovecot: An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more... 5.9 0.0021 None reported
Routine CVE-2026-40204 dovecot: None None None No publicly available exploits are known. 3.1 0.0021 None reported
Showing 1 to 17 of 17 1