-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 16 Sep 2026 15:06:35 -0400 Source: dovecot Binary: dovecot-auth-lua dovecot-auth-lua-dbgsym dovecot-core dovecot-core-dbgsym dovecot-dev dovecot-flatcurve dovecot-flatcurve-dbgsym dovecot-gssapi dovecot-gssapi-dbgsym dovecot-imapd dovecot-imapd-dbgsym dovecot-ldap dovecot-ldap-dbgsym dovecot-lmtpd dovecot-lmtpd-dbgsym dovecot-managesieved dovecot-managesieved-dbgsym dovecot-mysql dovecot-mysql-dbgsym dovecot-pgsql dovecot-pgsql-dbgsym dovecot-pop3d dovecot-pop3d-dbgsym dovecot-sieve dovecot-sieve-dbgsym dovecot-solr dovecot-solr-dbgsym dovecot-sqlite dovecot-sqlite-dbgsym dovecot-submissiond dovecot-submissiond-dbgsym Architecture: amd64 Version: 1:2.4.1+dfsg1-6+deb13u7 Distribution: trixie-security Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) Changed-By: Noah Meyerhans Description: dovecot-auth-lua - secure POP3/IMAP server - Lua authentication plugin dovecot-core - secure POP3/IMAP server - core files dovecot-dev - secure POP3/IMAP server - header files dovecot-flatcurve - secure POP3/IMAP server - Flatcurve support dovecot-gssapi - secure POP3/IMAP server - GSSAPI support dovecot-imapd - secure POP3/IMAP server - IMAP daemon dovecot-ldap - secure POP3/IMAP server - LDAP support dovecot-lmtpd - secure POP3/IMAP server - LMTP server dovecot-managesieved - secure POP3/IMAP server - ManageSieve server dovecot-mysql - secure POP3/IMAP server - MySQL support dovecot-pgsql - secure POP3/IMAP server - PostgreSQL support dovecot-pop3d - secure POP3/IMAP server - POP3 daemon dovecot-sieve - secure POP3/IMAP server - Sieve filters support dovecot-solr - secure POP3/IMAP server - Solr support dovecot-sqlite - secure POP3/IMAP server - SQLite support dovecot-submissiond - secure POP3/IMAP server - mail submission agent Closes: 1144639 1146018 Changes: dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium . * Import upstream fixes for multiple security issues. (Closes: #1146018) - CVE-2026-27852: DoS by sending mail with bad header - CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return - CVE-2026-33605: managesieve-login: Pre-auth crash - CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service - CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT - CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c) - CVE-2026-40015: imap-hibernate can be crashed - CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c) - CVE-2026-40018: MySQL multi-byte escaping wrong - CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl restrictions - CVE-2026-42007: Sieve editheader RCE - CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command - CVE-2026-42394: sieve: symlink traversal flaw could result in arbitrary file disclosure - CVE-2026-52681: Sieve resource usage tracking lost when active script changes - CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage - CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks - CVE-2026-33606: dsync: Mail content can cause dsync protocol injection - CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text - CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy - CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages - CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons - CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes - CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path - CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim * lib-mail: istream-header-filter - Fix potential assert-crash (Closes: #1144639) * CI: Disable test-build-twice job, which is known to fail on trixie Checksums-Sha1: 171f12ab03af7eb51cdca08a2a36dcdda41a8700 32648 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 2cb9ea30646a0d7d4b8fb6af40b38876b92de31c 23144 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_amd64.deb 9b3aaa184d9f17a75e4770b957d60a12bdf4797f 11199308 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 3005d63b8d2218467fea0b29bc051cdd8720beac 2724224 dovecot-core_2.4.1+dfsg1-6+deb13u7_amd64.deb d44d6e4b60a92d44e177a666436d143f2f5c68eb 434232 dovecot-dev_2.4.1+dfsg1-6+deb13u7_amd64.deb 5bfe34a3f0da68103ebaf0ad7dec862cf8cd7ebe 190460 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 79793b0342f366eb4d04138d663a632cb388270d 43712 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_amd64.deb 2e4cf111f2835ef379bcc6da58709a0f1147689c 21212 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 10d249720c3d3300e80364cd6f34ee235081a9d4 19464 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_amd64.deb 2d159ead53197b8cfec69ce157814a93af685795 828060 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 9fa1005def4af4a1c3a9e7b519409bfe294f6210 196964 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_amd64.deb b6ca9a728451daf4e90466c127c9ef2d1f830023 195400 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 1607f21036eab8bac6e47ca8bd9955e55c19cfb3 54964 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_amd64.deb a66af5ed3865e996372087812503f14e735a4276 101840 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 3c04a8f0a6ca7cea48abede928fe0cfa62d7d4de 37704 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_amd64.deb fe97d5c8ca05d8fc1f28c8c7eef0bc32883eddae 127408 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 473e84b76610fb9512fc6b119806cdd0e7d944fd 49592 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_amd64.deb 328d4c1a747cf8e85035f501bbbc29cf03c9eef9 35476 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb d003133711a5d83b1cdfbc07fe0b3bf502d9bf9b 22088 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_amd64.deb 08d35ea74c480e11734689ea690b1269d546a631 39376 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb f5aef9eecb0577ab5309e2921c89516b6425b138 26128 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_amd64.deb af332cc7dc238635013ddbefdfc88fe197a7831e 106844 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb b5675e62e6835eeeb617f6d9c1a3cdf592ce40e1 45884 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_amd64.deb 57274a14eac37b2584a24ffd90647913a5435ac8 1776912 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb fddb85196b14f9ea9988b19b4f60776c0d23e219 385208 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_amd64.deb 835d090c01b58b0ce98b1d6f0e0af4c54397b2f5 75360 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 26d1fa927a7d26970db459923a540e786db366b8 39092 dovecot-solr_2.4.1+dfsg1-6+deb13u7_amd64.deb 960023cf91ed5295ae7b4fd81e862464328090d2 24596 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 4e95e680dd3d6a1fba2c3a8dc81d0c735293bae0 21076 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_amd64.deb d17bec1eafb6500f8479f1792b7c45991dc64420 214532 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb cf40e1c815c88fa66222cec90a17c0ed5da85793 62728 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_amd64.deb f17e12f7014dea7e00aa9f5a7d1f37331ce52b63 18262 dovecot_2.4.1+dfsg1-6+deb13u7_amd64-buildd.buildinfo Checksums-Sha256: 6502dfb093ad39f79db20ab5df20a8d595e965f7fc37ace447f63a90e1bf485b 32648 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 347fa789d947b3eb883a5ea4a54a98a1cdce00973637bd8b271c1e037bbe09d3 23144 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_amd64.deb df1a45f80b596ad9d134f565273b2d960247f191cf9b7378bec25a38fb71b88d 11199308 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 96e6b0da214ca6b0329f97b2f8b07b9f70ab5f834b012a8e3fc573892d3e91b3 2724224 dovecot-core_2.4.1+dfsg1-6+deb13u7_amd64.deb 42148f833d3a969bfb6129cf0aa1e204ad5cdeb1b8a695e31cf534539b66fe34 434232 dovecot-dev_2.4.1+dfsg1-6+deb13u7_amd64.deb 231717a6c28f19cd3d0bded7ca24097a78663b8ecf6e3640e5980783adca1341 190460 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 02ddb9c1139d7efdf30712ae2323a64f84e53e75691c1bff189cbcb088c44ab1 43712 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_amd64.deb e904c92da53eeb5b97581b0c508d9887ee6f44cdfe5c6a16c02aacd136e06185 21212 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 54965dfcf17aa0359c9e753cc3cb9be9ab4f013ce25dfb3f7b8582f605c7a713 19464 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_amd64.deb 1f8e7ce4aa180bb81191039e0e8d4ab975e9516ac96d1cfd8fca5b46aaa93704 828060 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 668751789d7aa392de62b6b114565831a9f2dec43dd7abbac5bb1d2b5bc55273 196964 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_amd64.deb 6315a6db232ac5a4a0e1f9e439f15449d7ec383e6dbc83ea3338c71fff795c59 195400 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 5e8671262e65910900c3778e9950431009df9043289a22df9f61faf6a006c1fb 54964 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_amd64.deb ab7e450aa18e416bdfe990b794380a871c6786c70bafc2ff83cc14f04388e16f 101840 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb b0ad28f0dae8c326e67c74ce555d2e95bea0fd03c26e44aae91967a02230a09d 37704 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_amd64.deb 003967f4d558f2eae525dbd73d1cbcb385758bc31475b51097b6ca847ee59a89 127408 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 173a15b4b8970a4cb8d8bbba7b99a8332d06292219f0ec27b5a03e1e13d5e895 49592 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_amd64.deb 1b1992c2e4432677d10a9397b84a84575aeb480d1fdffc492af65f0cdfa62d2a 35476 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb d9d6dc3087a58b838b4a87089f388f412fa2d5990a5bec0c4e6440475cd3dc8d 22088 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_amd64.deb 0551973c12e39451b16fdf83974341574281aec19ced87f1b80e64bd2441fb81 39376 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 3a5f901822e78390e347c59fc073a610239df6b7e9ede97f7add6fed702dd6fa 26128 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_amd64.deb f117f356ba0a5049b22f54f4c48a84da20592278b0d4b188a05fe073f5157f77 106844 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb ac24d4c923e58b9f67a290db5ef47d284af58a1dbcbd18606d776e8e40824659 45884 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_amd64.deb b03b8d5c50263a3a4d9e2f2d953a8621e843accbb9277e2d2d07e070d38579ad 1776912 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb ee96cb0dffdc3b2620ab9cd58019dd0628f42e863974008e0f3a2b6d369ec941 385208 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_amd64.deb 23227726f9e8006e08445e2663b367d25312f7642eacaba15013f64343bed487 75360 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb dc8c1f5a76334f3900823c349c3d3382b6693c45fb4e51579feae91370da62dd 39092 dovecot-solr_2.4.1+dfsg1-6+deb13u7_amd64.deb 8b753270c822d9ff49309f64272419ca65a2f34a3ad5515b9b71fda7732fd0be 24596 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 7821f4d1758f0c15578ccd89d435a83b224772365ee67a383004e9d20c8a915c 21076 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_amd64.deb dc909d569fbe760355bb8a9b19cbe951eefde19dc7f14da77fc45e956665b3da 214532 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb c7a2070ca512826a2ee6443a0714bf1eb3f7ef515799b9bc1fe914e577310ca0 62728 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_amd64.deb 9c014aae69c2998bbf4fb22c02d9848e867f47678b1e19699a5ba6076233a8c1 18262 dovecot_2.4.1+dfsg1-6+deb13u7_amd64-buildd.buildinfo Files: d46958cafbef6ac0da6ca5c317c6c386 32648 debug optional dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb ee37ba500a4df56e108ccc315c48b252 23144 mail optional dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_amd64.deb 35f0462df7d91c11a38de228d135a9b4 11199308 debug optional dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb db395e99f0a28a977ce4005d197bcc79 2724224 mail optional dovecot-core_2.4.1+dfsg1-6+deb13u7_amd64.deb 8c7a30995fe6dd1e1b50af0605c60f0e 434232 mail optional dovecot-dev_2.4.1+dfsg1-6+deb13u7_amd64.deb 773a55dc10495283d62adb587e13f241 190460 debug optional dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 0c72fdb1523fc54b678246c7f4370099 43712 mail optional dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_amd64.deb 368aef0fd7daf7301bb9901237fc133e 21212 debug optional dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 8d2907c11c70d757be5f910d11f60a68 19464 mail optional dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_amd64.deb d88a6e532d02cd96bddc1ddac274b211 828060 debug optional dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb d308ad79376a274b52f8bf36abaa3091 196964 mail optional dovecot-imapd_2.4.1+dfsg1-6+deb13u7_amd64.deb 8eb3c62282285ee8803efecd4e0c647a 195400 debug optional dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 65a45ba4fbe1b15b00d5561eb194d743 54964 mail optional dovecot-ldap_2.4.1+dfsg1-6+deb13u7_amd64.deb 6de15d5b7ef65a0c0baf549315d8c225 101840 debug optional dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 4abbf777a4de6394771cb84a64288c15 37704 mail optional dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_amd64.deb b21cd28b3bc73bae296c807beaae6454 127408 debug optional dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 4a7eef9373781ad50afbb24434bceb17 49592 mail optional dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_amd64.deb 2cbe1020abc6e915acb1fdeb62a6088e 35476 debug optional dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb edecc68e744c276c2beb6c07106b52fa 22088 mail optional dovecot-mysql_2.4.1+dfsg1-6+deb13u7_amd64.deb 5a43b9a849920de1e74cd1ddaab7e8fd 39376 debug optional dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb d5741d4c02ce676d414969369ac0b988 26128 mail optional dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_amd64.deb ebc8a53e670d61d81c652866f1b58c84 106844 debug optional dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb cffbc21eba929c9a006aee2b03ba705a 45884 mail optional dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_amd64.deb 8b64106e81642ace5692d6e1600c6caa 1776912 debug optional dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 7b2c873a2ad90189acd805c9443fc0f5 385208 mail optional dovecot-sieve_2.4.1+dfsg1-6+deb13u7_amd64.deb 3e1db3993e44f742cd8db4a8b5fdce97 75360 debug optional dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 9664ee1e47b95cc6ee3a7a5e8245bed1 39092 mail optional dovecot-solr_2.4.1+dfsg1-6+deb13u7_amd64.deb ccf0d04fe5e229ce18f0aa50f34339f3 24596 debug optional dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 29512bbafc999464c214b20432457124 21076 mail optional dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_amd64.deb 31f8361588a0e2078bd8fa3637b04dfd 214532 debug optional dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_amd64.deb 3f9a24f2e1422a8c9e9fadae6db57c1f 62728 mail optional dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_amd64.deb 540f5ce1b7b8afc73aa5b831c4f2f32f 18262 mail optional dovecot_2.4.1+dfsg1-6+deb13u7_amd64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmq5IncACgkQPkCWRKsh 20fPZw//UTEoxQL5lK1kJTsmD2pDRzTDjFL2CJmedBT0qj0yNHIpZkKaYBmsUZhV 5Mdkz4nHx2crE9lAgAiCcXRlXUv5r+zEhaDEWQUhol4bY2TQvIZ4/Nx3F80ijRIY s9Pop4M3qEpk7or7oebYTGmWuBpMdk836Jwc8AUNW3LunUs6SScB3yPx64kTgtgk m2BzyEc+JkfbTr2j3iczjOTawtRcVN4/DGsRHzy9BhBYrcsp9r/kIiOVlJnXCAJO SQFdwO6kGUkbxmdMmHqBTpDVdvZ5mayaSe6rKhy57VaKpjxPgEQXSZ+OFrSr6oKX n5YXqeFrDHLIbrhrynBy0LCEqHqt5ZX8YVb3CrDW7OMXcx7aDpJ9ABC1g+YN6ZqW 8sDtJp2TPqTpoI5+vPKGnr6GyDP/GZ7r9A7CgoOoTTMumx5GoVHPYL/pN4e+Zy9t E1Na1gfcmWY0JvRSJ8ZpLejHdhzMtMMkvNxlCVeF1/EGyTvMxIz9RPFaC8muAsWr havPzouxtL3RG8c94Wb0oUmWNMuykQInSYMHYdx9WMKxK7StE77QywKsjSTvj1hg 8UCN2ghQGNenEtrFsm90zTp0hOqcTHeGgiFM3jzJNWIifsALdu09fWALSnDRHThh M0qnsRn2Xo+bielbFM2Kyh+td/kw4AesXYUAdH/no00PImvrKR8= =YS/Q -----END PGP SIGNATURE-----