Linux · 
openSUSE Leap · Security advisory · September 1, 2026
openSUSE Leap · Security advisory · September 1, 2026OPENSUSE-SU-2026:21720-1: dovecot24 security update
OPENSUSE-SU-2026:21720-1, released September 1, 2026, fixes 24 CVEs in dovecot24 (version 2.4.4-160000.2.1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
24
None rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0087
59th percentile
Priority of the 24 CVEs
Patch now 0
Urgent 0
High 7
Routine 17
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| dovecot24 | opensuse-leap 16.0 | 2.4.4-160000.2.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2026-33263 | dovecot: When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic cause... | 9.1 | 0.0055 | None reported |
| High | CVE-2026-33605 | dovecot: An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authe... | 9.1 | 0.0045 | None reported |
| High | CVE-2026-42391 | dovecot: An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, whi... | 9.1 | 0.0045 | None reported |
| High | CVE-2026-27852 | dovecot: Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind | 9.1 | 0.0043 | None reported |
| High | CVE-2026-42007 | dovecot: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-fr... | 9.1 | 0.0035 | None reported |
| High | CVE-2026-40018 | dovecot: None None None No publicly available exploits are known. | 9.1 | 0.0032 | None reported |
| High | CVE-2026-73208 | dovecot: An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token respon... | 9.1 | 0.0031 | None reported |
| Routine | CVE-2026-40013 | dovecot: An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes... | 4.3 | 0.0087 | None reported |
| Routine | CVE-2026-33607 | dovecot: An attacker that has valid credentials can use IMAP LIST command to consume CPU | 4.3 | 0.0055 | None reported |
| Routine | CVE-2026-40015 | dovecot: An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid comma... | 4.3 | 0.0055 | None reported |
| Routine | CVE-2026-52687 | dovecot: An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression... | 6.5 | 0.0040 | None reported |
| Routine | CVE-2026-73209 | dovecot: An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust i... | 6.5 | 0.0040 | None reported |
| Routine | CVE-2026-42395 | dovecot: A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login proce... | 4.3 | 0.0035 | None reported |
| Routine | CVE-2026-40014 | dovecot: An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU di... | 6.5 | 0.0033 | None reported |
| Routine | CVE-2026-40017 | dovecot: An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal... | 6.5 | 0.0033 | None reported |
| Routine | CVE-2026-33604 | dovecot: An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use... | 5.9 | 0.0031 | None reported |
| Routine | CVE-2026-52681 | dovecot: Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the a... | 3.1 | 0.0030 | None reported |
| Routine | CVE-2026-42392 | dovecot: An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory t... | 4.3 | 0.0027 | None reported |
| Routine | CVE-2026-40203 | dovecot: When IMAP compression is enabled, the same compression state is reused across responses in a session, so response siz... | 3.7 | 0.0026 | None reported |
| Routine | CVE-2026-33606 | dovecot: Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrat... | 4.8 | 0.0025 | None reported |
| Routine | CVE-2026-42008 | dovecot: Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authent... | 4.3 | 0.0024 | None reported |
| Routine | CVE-2026-40205 | dovecot: An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more... | 5.9 | 0.0021 | None reported |
| Routine | CVE-2026-40204 | dovecot: None None None No publicly available exploits are known. | 3.1 | 0.0021 | None reported |
| Routine | CVE-2026-42393 | dovecot: The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the co... | 3.1 | 0.0017 | None reported |
Showing 1 to 24 of 24
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.