-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 16 Sep 2026 15:06:35 -0400 Source: dovecot Binary: dovecot-auth-lua dovecot-auth-lua-dbgsym dovecot-core dovecot-core-dbgsym dovecot-dev dovecot-flatcurve dovecot-flatcurve-dbgsym dovecot-gssapi dovecot-gssapi-dbgsym dovecot-imapd dovecot-imapd-dbgsym dovecot-ldap dovecot-ldap-dbgsym dovecot-lmtpd dovecot-lmtpd-dbgsym dovecot-managesieved dovecot-managesieved-dbgsym dovecot-mysql dovecot-mysql-dbgsym dovecot-pgsql dovecot-pgsql-dbgsym dovecot-pop3d dovecot-pop3d-dbgsym dovecot-sieve dovecot-sieve-dbgsym dovecot-solr dovecot-solr-dbgsym dovecot-sqlite dovecot-sqlite-dbgsym dovecot-submissiond dovecot-submissiond-dbgsym Architecture: arm64 Version: 1:2.4.1+dfsg1-6+deb13u7 Distribution: trixie-security Urgency: medium Maintainer: arm64 Build Daemon (arm-ubc-02) Changed-By: Noah Meyerhans Description: dovecot-auth-lua - secure POP3/IMAP server - Lua authentication plugin dovecot-core - secure POP3/IMAP server - core files dovecot-dev - secure POP3/IMAP server - header files dovecot-flatcurve - secure POP3/IMAP server - Flatcurve support dovecot-gssapi - secure POP3/IMAP server - GSSAPI support dovecot-imapd - secure POP3/IMAP server - IMAP daemon dovecot-ldap - secure POP3/IMAP server - LDAP support dovecot-lmtpd - secure POP3/IMAP server - LMTP server dovecot-managesieved - secure POP3/IMAP server - ManageSieve server dovecot-mysql - secure POP3/IMAP server - MySQL support dovecot-pgsql - secure POP3/IMAP server - PostgreSQL support dovecot-pop3d - secure POP3/IMAP server - POP3 daemon dovecot-sieve - secure POP3/IMAP server - Sieve filters support dovecot-solr - secure POP3/IMAP server - Solr support dovecot-sqlite - secure POP3/IMAP server - SQLite support dovecot-submissiond - secure POP3/IMAP server - mail submission agent Closes: 1144639 1146018 Changes: dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium . * Import upstream fixes for multiple security issues. (Closes: #1146018) - CVE-2026-27852: DoS by sending mail with bad header - CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return - CVE-2026-33605: managesieve-login: Pre-auth crash - CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service - CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT - CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c) - CVE-2026-40015: imap-hibernate can be crashed - CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c) - CVE-2026-40018: MySQL multi-byte escaping wrong - CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl restrictions - CVE-2026-42007: Sieve editheader RCE - CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command - CVE-2026-42394: sieve: symlink traversal flaw could result in arbitrary file disclosure - CVE-2026-52681: Sieve resource usage tracking lost when active script changes - CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage - CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks - CVE-2026-33606: dsync: Mail content can cause dsync protocol injection - CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text - CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy - CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages - CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons - CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes - CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path - CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim * lib-mail: istream-header-filter - Fix potential assert-crash (Closes: #1144639) * CI: Disable test-build-twice job, which is known to fail on trixie Checksums-Sha1: 215660cf4f19aac11a21a873a1afa7d56a7c05e2 31856 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 56b0f6941c9ed728bf283840aa63e8cdf76ccd65 22580 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_arm64.deb 06b7f8a4b8fa2c33a545603f5530d9f39886b73c 10778040 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 951417eb53263865c7a696f434e43618f9e63396 2510760 dovecot-core_2.4.1+dfsg1-6+deb13u7_arm64.deb bfbbdb741fe65b0702043345a924f2cb305c8439 434232 dovecot-dev_2.4.1+dfsg1-6+deb13u7_arm64.deb 9a24d121a7625d7514e02ca3ab53d363a8786740 185616 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 386147e75f26fad435c0ce9ab64ca8377adaa7b2 41304 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_arm64.deb f3c4d68174826799ad55619414c82cd971136dfa 20944 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 173029165c2017efebe22fd7b87392b4add43fc7 19480 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_arm64.deb fed64880a3721391931ef15411c1679c68c0079c 805572 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 077b486a0defd050aa5c4144115dde7042ad52ae 185124 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_arm64.deb 36c5d894d0b6f3e02eba2b2c873ef987ae927090 189696 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb f08a93639d8dcc0e6c639436ef5bc089bdc82c86 52244 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_arm64.deb 7462ee126dc9e29257092449ddbc5b2fbfa2fd34 99540 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb d7e19776f5369f674659b39a7a58ad7e168b9964 36488 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_arm64.deb d84993ae4f46e6f227fa3293e5be6d06e63f6a6d 125240 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb c9be145ead090d0b70ff452cfc0cb03a324196ff 47648 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_arm64.deb ff102b39ebeffdc94ca1217a21c169dbc4bcf562 35304 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 84c8966e793191499fdda8f8d37946fb0876b672 21652 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_arm64.deb 6f9b050f72f40f103a424ef2bd3aab800b466160 38008 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb cfd119639b5f75c9b7437e56b89d82b9e96c3d44 24880 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_arm64.deb cc6498f174508bf3f26fc24e5462ad3d64567af7 104992 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb d0f6161ad35ac61c5b093fbad6306bab275363f8 44540 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_arm64.deb 54fced15bf5bd9193abcf9a4e360868883fb2e2b 1731032 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 68636d3cc29b949023f7ac24032e59f2dcad60a6 353920 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_arm64.deb ad59f5a77380aec2f5be580e165ec959f2e04ae0 73944 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb deb87c2226bfd2bc1a6059dd13ae1357fc0e89c5 38436 dovecot-solr_2.4.1+dfsg1-6+deb13u7_arm64.deb da1a57d2f8f8dbb75544a0d84bd7942624f958a1 24356 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 1040ba85b65e3d4de20e53ff1bfa2f7a31d74509 20900 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_arm64.deb 5f2876788d74d630764963207a998727190b9f40 209092 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb a84684b6eb5abcbbddd73d52b05a5c3f1345881b 59500 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_arm64.deb 961b18ea7a0906fa5cdbf3713a5616d8d16aa6cc 18243 dovecot_2.4.1+dfsg1-6+deb13u7_arm64-buildd.buildinfo Checksums-Sha256: a1bb2464ee180d044510ea9f6f5a10cee715f7fc42cc4cdea30c9b989cf05146 31856 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb c1d4fe2b370ae93195f8a2d298c367197574b67b29d6693eb450d162e47f58af 22580 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_arm64.deb b84048de643f1422d6705f5f2c80fe4180bc1016eda77277e15995d7056d09c4 10778040 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 14b124f02a89cd3466b5a60a5fb7581b46693c0d91d07cc4b8fc5a571157cb0a 2510760 dovecot-core_2.4.1+dfsg1-6+deb13u7_arm64.deb 7315c335bfc22d810c525f60514e8d31e6b9398e118353573dad61af26be8719 434232 dovecot-dev_2.4.1+dfsg1-6+deb13u7_arm64.deb 5a38bc0473ded7fe113e7623164febcce178780c25117d7b6945ce72f5cb2136 185616 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 604c193adae467a653bd41ade2c34b79baf754b802c8d0f6844fd91e7928741c 41304 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_arm64.deb c2fdf06cd3b24125182c4e0bc1e894d4856e4dc146f676ed2c7497212571b24b 20944 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 6195a5bcac4696c42ba18b6e0b9c448177d24722a337f8581eb1988c7c9666c3 19480 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_arm64.deb b5ee003b3fe45a09d95554996ab9c538a53e4e66fbb58be5e975cf42886b2e67 805572 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 0abdfb677faf4fa74d54236d27cd08b4b51d919c228fdfab82f95ef0995c3ddb 185124 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_arm64.deb 083a4e08e7580210f6b6ff6adde12a98708761613b3ed4ef32159e7daa9fb5b4 189696 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 2dd386bbfba85415abaa60e52372e0f33414c2d4ad4d4a1e19ebfe5ae14bb5b3 52244 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_arm64.deb ea0609028e10f60b9afb8e28252f4fd7c715197efe23055612ffdee10042329c 99540 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb fd161b6bad2124d67dad8d28d7c08521d61e9f2a2e209bd0d590b80fba658151 36488 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_arm64.deb f8d3dee097cd57073fe5336cff464a54d1791dd3dde25db3aaa4822333122287 125240 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 157ce83437969d4170d76e7ff8b05e283b5e9e4f84b363e83ad7dde85689a312 47648 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_arm64.deb 09a93c412c227c39d218e62ab9c9f368a674783fdb25e2f34425ec7dd5fa3988 35304 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 3fd9dc56921d3c7c94881b0b36a308a4a4d909f697924c86123a6d853cdf0184 21652 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_arm64.deb 23743f28023af1a82ad0fcd659b71110522c1ead23fe1a0494f1043798f2ea3a 38008 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 7cb7935264c5eeea1ea670ca8270a02fea864c9fd558b77bbf90181f86001e5d 24880 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_arm64.deb 4717b333cb4656a69309fbcd238ae6f10131f565ea6598e1a8f4f6f6acff72c8 104992 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb b776ae4f277b9445f679409d6a98968f0203be5f657b977a563a743a0db531c9 44540 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_arm64.deb 0ebc57aa430eedb3b652d5853f5e9137c3b1d33845a47dce6186e07bc9813340 1731032 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 211f180f19e48c5acdbc0eb8876146aae7feedf0d77dc0a317a244976c1ab62f 353920 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_arm64.deb 0dcf43cb9feb0a38db15fb7425302f30da61830775929419b111c9743ad14266 73944 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb efcca0a8c7f2bb70e429cd24e9b820b8310275a0056347118094fb1e8fa517d6 38436 dovecot-solr_2.4.1+dfsg1-6+deb13u7_arm64.deb 4686afe41714d6e282a4ba7ec8318c6bd788e54495ae86fec2ab3d65d431e217 24356 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 7693dd935f627a7ac069706804054b7ae3ffa1ad5ee1cd82d30fe1a70286b916 20900 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_arm64.deb c6f7abbd272ff714deaf87b86c1eaed7e69bcdb6c0a3d0a89e05bcc7f53ee448 209092 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb d8458f234a888c484f5fb607d77a0c1e4a1747df53acb9c2e4a1d72322fbc474 59500 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_arm64.deb 840f65553347ac654d13390bee92d90c95a1d2681f3c0d4603c927adff407d1a 18243 dovecot_2.4.1+dfsg1-6+deb13u7_arm64-buildd.buildinfo Files: 49c7ba75097ba663f2263ec5f4f0f2d2 31856 debug optional dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb fe41877c49228d0d971cba2413f42c49 22580 mail optional dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_arm64.deb 43189a2a7e5a5250e79a122d2f24629b 10778040 debug optional dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 5eaaa6ced17c95e9167b146dffc0cfa5 2510760 mail optional dovecot-core_2.4.1+dfsg1-6+deb13u7_arm64.deb 810396062146343b1944568909f3d904 434232 mail optional dovecot-dev_2.4.1+dfsg1-6+deb13u7_arm64.deb 2ca130ccb7ddeab61894ad0dc164078b 185616 debug optional dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb d4ec94fc7f187de39ed191e239babbc2 41304 mail optional dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_arm64.deb 974f91b1e4229404a53e6fddf133b206 20944 debug optional dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb eaf84790d36dcebe2070ec0bbced6c2d 19480 mail optional dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_arm64.deb 92db431e3ea5ad01f5b3492faee45689 805572 debug optional dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb b2d1e264d89adb7eee5943f4b76e3647 185124 mail optional dovecot-imapd_2.4.1+dfsg1-6+deb13u7_arm64.deb 797a37c8b54e74b5ce902939c134cca4 189696 debug optional dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb bb9ff81c7f89a906bcd9fb5c52c6e524 52244 mail optional dovecot-ldap_2.4.1+dfsg1-6+deb13u7_arm64.deb 17f8f3e2bc529e1c1a9d6305c20b400e 99540 debug optional dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 56f5f8670d587378736102a5b02d3aa9 36488 mail optional dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_arm64.deb 677a02ba9cf45e136a443d05d9d0df94 125240 debug optional dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb cc938d4fcc097928cc6006659a0a1b8a 47648 mail optional dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_arm64.deb 64db7e1b3d707621c8c89d245378e8c0 35304 debug optional dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 379494565dc1343987bccb5ae7a39564 21652 mail optional dovecot-mysql_2.4.1+dfsg1-6+deb13u7_arm64.deb bb5843da6c948e71171a6f1c9d7683c0 38008 debug optional dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 3ab4f6308196b1829399973dee4b2996 24880 mail optional dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_arm64.deb 025e7ecae8e73441edb5fd6ef7530b4d 104992 debug optional dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb f64b1a5efcd3dcf4a20db5525772da44 44540 mail optional dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_arm64.deb ba2b8b45bd34a6b779c041ceb0724144 1731032 debug optional dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 753e7065bf66a93fd1ffb133b02b7f2f 353920 mail optional dovecot-sieve_2.4.1+dfsg1-6+deb13u7_arm64.deb 0d0c47ff89e80cb092aea1fb45599d3e 73944 debug optional dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 25db24793d258727b0ccb57d7d601a29 38436 mail optional dovecot-solr_2.4.1+dfsg1-6+deb13u7_arm64.deb 40e40d4a3ea077c0a2dcf13afb3adb0d 24356 debug optional dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 6c7ad1f1271b5491b5a3002d09305640 20900 mail optional dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_arm64.deb 01892ce046799b06f957ef32ee610841 209092 debug optional dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_arm64.deb 6c81e66c48669431e183c6f075c5ea44 59500 mail optional dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_arm64.deb a01524b41689dabc4f1ac00541b7597e 18243 mail optional dovecot_2.4.1+dfsg1-6+deb13u7_arm64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEJkN0BnKzGWWW6tS+G5VHrWJmwgcFAmq5IkYACgkQG5VHrWJm wgd1wRAAp4VE9Y76WLMNxYunQdw/Qi4EnMEh4Dv21+CZvNYwrRTQiZGdGr9bw67q BJ6KWgxBqGl6rsp0/hrQ/z3CdlMXslIa0ASjRFoiP7sH/Bg8pv/YMso5AbcBxvw5 bBDx7eXWfv7bCrI9PgXacrQ/zYa5yBEzXA1GSjWDudoaj8n75VLEmrfAR3dPaXme jWPyr3J0R5U06vi/0inRzk6drn0ZrHAVtqIFglS9u1NIDWRIthM/ZZfUsQqfUv5F 5nQWbNDVVbTD47So2auyCrbFf03lVTx5I5RT7efQZBc0wIVpDvv8yeUBbf7cVKBL 8hJc5P2J17tufR99Sktb0hfoQYxq2w99UUZOtYMJXE51ORUNlgr3P1eeiEVpjY6M b8Z7Q+wpxrioS4y/6oiH64E1j/av4iL+2jm7P1BDfqg12GaUzc1hqqPPBGrskY+i kktiRYy8gWe37ik4U70ihwkbcvjGkKxcYmWdIEQHUGrrOid0Pn7uQGeUnqokD9vr lhGroVZajFmSw5aG+mKGnWSsHTcEq3VmsePV4SJDYRmnJoo8fA4PrU6ZYs0YSX/Y pkCKYtO5seIq8OQthJJcn0Mtw4p+VxUUSnf2grW51h5rZjgkvxthCD/7rQ22c9ph BgImDkC55IgSaHvyP3Sdd+2ciEGwsfmfNS3zJxUaGKBuIOIA3tk= =32Z4 -----END PGP SIGNATURE-----