Linux · SUSE Linux Enterprise · Security advisory · September 14, 2026
SUSE-SU-2026:4139-1: dovecot23 security update
SUSE-SU-2026:4139-1, released September 14, 2026, fixes 34 CVEs in dovecot23 (version 2.3.21.1-150200.76.1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
34
None rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0130
70th percentile
Priority of the 34 CVEs
Patch now 0
Urgent 0
High 13
Routine 21
Fixed package versions
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2024-23185 | dovecot23: large headers can cause resource exhaustion when parsing message (bsc#1229183). | 7.5 | 0.0130 | None reported |
| High | CVE-2026-27858 | dovecot23: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901). | 7.5 | 0.0080 | None reported |
| High | CVE-2025-59032 | dovecot23: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902). | 7.5 | 0.0073 | None reported |
| High | CVE-2026-27857 | dovecot23: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898). | 7.5 | 0.0068 | None reported |
| High | CVE-2026-42006 | dovecot: An attacker can cause uncontrolled memory usage with excessive bracing over IMAP | 7.5 | 0.0062 | None reported |
| High | CVE-2026-33263 | dovecot: When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic cause... | 9.1 | 0.0055 | None reported |
| High | CVE-2025-59028 | dovecot23: Invalid base64 authentication can cause DoS for other logins (bsc#1260894). | 7.5 | 0.0046 | None reported |
| High | CVE-2026-33605 | dovecot: An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authe... | 9.1 | 0.0045 | None reported |
| High | CVE-2026-42391 | dovecot: An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, whi... | 9.1 | 0.0045 | None reported |
| High | CVE-2026-27852 | dovecot23: DoS by sending mail with bad header (bsc#1276799). | 9.1 | 0.0043 | None reported |
| High | CVE-2026-40019 | dovecot: An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spi... | 9.1 | 0.0037 | None reported |
| High | CVE-2026-42007 | dovecot: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-fr... | 9.1 | 0.0035 | None reported |
| High | CVE-2026-73208 | dovecot: An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token respon... | 9.1 | 0.0031 | None reported |
| Routine | CVE-2024-23184 | dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU | 6.5 | 0.0085 | None reported |
| Routine | CVE-2026-33607 | dovecot23: IMAP LIST match_sub() Exponential Backtracking -- CPU Denial of Service (bsc#1276795). | 4.3 | 0.0055 | None reported |
| Routine | CVE-2026-40015 | dovecot23: imap-hibernate can be crashed (bsc#1276812). | 4.3 | 0.0055 | None reported |
| Routine | CVE-2026-27856 | dovecot23: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899). | 5.9 | 0.0040 | None reported |
| Routine | CVE-2026-52687 | dovecot23: IMAP: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837). | 6.5 | 0.0040 | None reported |
| Routine | CVE-2026-73209 | dovecot23: imap-login crash: Self-recursion on zero-output decompress chunks (bsc#1276833). | 6.5 | 0.0040 | None reported |
| Routine | CVE-2026-27859 | dovecot23: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897). | 5.3 | 0.0038 | None reported |
| Routine | CVE-2026-42395 | dovecot23: Single NUL-Byte XCLIENT FORWARD Payload Crashes (bsc#1276826). | 4.3 | 0.0035 | None reported |
| Routine | CVE-2026-40016 | dovecot23: Sieve :contains/:matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148). | 6.5 | 0.0034 | None reported |
| Routine | CVE-2026-40014 | dovecot23: CPU DoS via Crafted References Header (bsc#1276804). | 6.5 | 0.0033 | None reported |
| Routine | CVE-2026-27855 | dovecot23: OTP driver vulnerable to replay attack (bsc#1260900). | 5.9 | 0.0032 | None reported |
| Routine | CVE-2026-33604 | dovecot23: SMTP Smuggling via Missing Dot-Stuffing (bsc#1276802). | 5.9 | 0.0031 | None reported |
Showing 1 to 25 of 34
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.