-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 16 Sep 2026 15:06:35 -0400
Source: dovecot
Binary: dovecot-auth-lua dovecot-auth-lua-dbgsym dovecot-core dovecot-core-dbgsym dovecot-dev dovecot-flatcurve dovecot-flatcurve-dbgsym dovecot-gssapi dovecot-gssapi-dbgsym dovecot-imapd dovecot-imapd-dbgsym dovecot-ldap dovecot-ldap-dbgsym dovecot-lmtpd dovecot-lmtpd-dbgsym dovecot-managesieved dovecot-managesieved-dbgsym dovecot-mysql dovecot-mysql-dbgsym dovecot-pgsql dovecot-pgsql-dbgsym dovecot-pop3d dovecot-pop3d-dbgsym dovecot-sieve dovecot-sieve-dbgsym dovecot-solr dovecot-solr-dbgsym dovecot-sqlite dovecot-sqlite-dbgsym dovecot-submissiond dovecot-submissiond-dbgsym
Architecture: armel
Version: 1:2.4.1+dfsg1-6+deb13u7
Distribution: trixie-security
Urgency: medium
Maintainer: armel Build Daemon (arm-ubc-01) <buildd_arm64-arm-ubc-01@buildd.debian.org>
Changed-By: Noah Meyerhans <noahm@debian.org>
Description:
 dovecot-auth-lua - secure POP3/IMAP server - Lua authentication plugin
 dovecot-core - secure POP3/IMAP server - core files
 dovecot-dev - secure POP3/IMAP server - header files
 dovecot-flatcurve - secure POP3/IMAP server - Flatcurve support
 dovecot-gssapi - secure POP3/IMAP server - GSSAPI support
 dovecot-imapd - secure POP3/IMAP server - IMAP daemon
 dovecot-ldap - secure POP3/IMAP server - LDAP support
 dovecot-lmtpd - secure POP3/IMAP server - LMTP server
 dovecot-managesieved - secure POP3/IMAP server - ManageSieve server
 dovecot-mysql - secure POP3/IMAP server - MySQL support
 dovecot-pgsql - secure POP3/IMAP server - PostgreSQL support
 dovecot-pop3d - secure POP3/IMAP server - POP3 daemon
 dovecot-sieve - secure POP3/IMAP server - Sieve filters support
 dovecot-solr - secure POP3/IMAP server - Solr support
 dovecot-sqlite - secure POP3/IMAP server - SQLite support
 dovecot-submissiond - secure POP3/IMAP server - mail submission agent
Closes: 1144639 1146018
Changes:
 dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium
 .
   * Import upstream fixes for multiple security issues. (Closes: #1146018)
     - CVE-2026-27852: DoS by sending mail with bad header
     - CVE-2026-33263: submission-login: Panic when
       mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8)
       failed: Bad file descriptor
     - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare
       Carriage Return
     - CVE-2026-33605: managesieve-login: Pre-auth crash
     - CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential
       Backtracking — CPU Denial of Service
     - CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole
       ManageSieve CHECKSCRIPT/PUTSCRIPT
     - CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted
       References Header (index-thread-links.c)
     - CVE-2026-40015: imap-hibernate can be crashed
     - CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision
       in strmap (mail-index-strmap.c / hash2.c)
     - CVE-2026-40018: MySQL multi-byte escaping wrong
     - CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl
       restrictions
     - CVE-2026-42007: Sieve editheader RCE
     - CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command
     - CVE-2026-42394: sieve: symlink traversal flaw could result in
       arbitrary file disclosure
     - CVE-2026-52681: Sieve resource usage tracking lost when active
       script changes
     - CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage
     - CVE-2026-73209: imap-login crash: Self-recursion on zero-output
       decompress chunks
     - CVE-2026-33606: dsync: Mail content can cause dsync protocol
       injection
     - CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced
       Email Body Matches Sender-Chosen Text
     - CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows
       nopassword injection via trusted proxy
     - CVE-2026-42392: imap-urlauth leaks memory into user-visible error
       messages
     - CVE-2026-42393: doveadm_password or api key length can still be
       leaked with timing comparisons
     - CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes
     - CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR
       semantics in remote validation path
     - CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for
       missing scope claim
   * lib-mail: istream-header-filter - Fix potential assert-crash
     (Closes: #1144639)
   * CI: Disable test-build-twice job, which is known to fail on trixie
Checksums-Sha1:
 8f76762dd6a5d2823339f5d664208c51e2c7fd83 31988 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 ac7d249a7c1adb84a644db281c7b64ad035228be 22564 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_armel.deb
 08b92c66464a1bc4f3aabe90fafce44c77a2664e 9726044 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 8c8773bb4e98e712e2f63a3fdd30eece8cf8217c 2399572 dovecot-core_2.4.1+dfsg1-6+deb13u7_armel.deb
 18106eec2865e3346351805935af2b6a1875d236 434156 dovecot-dev_2.4.1+dfsg1-6+deb13u7_armel.deb
 c7c4a5f2ae60cf0c5de87948b325f6d0d455809b 185020 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 bf0c4277e770ff2c28d2021c540bb701e0911932 39744 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_armel.deb
 9862a500ff384b816093ebcf37ef501a956bcf04 21356 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 4a9b6f3066b868fa6aba9e58580b174d97b912b8 18968 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_armel.deb
 881c8dfb350b39a53b48c0cded9faa882d81f849 727456 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 b7b251373c201b26554a1ae79f622dd5c0ba59b5 174528 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_armel.deb
 3407617ce5a75dc3a6abf28d41d66900a7fda12b 163988 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 a893412b676da713059abae1595b965db914da52 49728 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_armel.deb
 8647e3cde4a4c7a1e45943017bd63cc34a4f2688 99756 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 e92e26c54d7e8983605b0b5567f5b667f383e32a 35608 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_armel.deb
 501983f876874c2c0586d6e689a03dca5092aa34 115964 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 12e68c67c8b3181a46e18d4f29f770d8342c2e9d 45632 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_armel.deb
 6974be0ec1b1fcb7c6c40dbda94b2ba21468b148 35528 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 182db60be2d68ffabf9d9a0373d07eaeb3a6c3e2 20928 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_armel.deb
 8afaeda2dd347bb62fdb28180ff450bb1a94f445 39072 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 078314d1f1a1726828d9c372e5cb95dcf29877c6 24936 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_armel.deb
 d3978af322c8b2833aebfd51236d6c73a7c78f22 101916 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 dfb36fcb6cb36cf51ae8b3824829c152bc3e65e2 42912 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_armel.deb
 c9da4040f481a9c989e66a403cca0eed683e342d 1661024 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 7f038ada51df6f068af1cf7755e801a6e6fbb614 333920 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_armel.deb
 11f54df937f033bb43e21fc36ced417bbf5e5aab 73760 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 a4da08ccd6acef5d3c0f6c9275d93df222d51d62 37684 dovecot-solr_2.4.1+dfsg1-6+deb13u7_armel.deb
 861252a0b9fe6fb0738f99cdd901d97b5b057cb9 25036 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 9c489abb8bacdfa5d7f00c728bd67f5ca5560747 20308 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_armel.deb
 fe14d509a305cfbf22c79f939d56dbc260dc202f 205704 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 81b374af60e6de191169a023f3e0a6cdc223ade4 56764 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_armel.deb
 9a88ed4586f628324e1be9445dc34684814aefb0 18108 dovecot_2.4.1+dfsg1-6+deb13u7_armel-buildd.buildinfo
Checksums-Sha256:
 4a9d5b5aca67411856afc6cb497c1a222ccbbfb391d3405e7baa67aa7e7e0c8c 31988 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 f8662a7aca91e0c4c9c33188873af6189f668790f42bbf81529b2e7ef8c53159 22564 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_armel.deb
 ac8f07ecfc9a43279866b9d8f3f615619895da892ba5a023b0cea03947513260 9726044 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 6e185e2ece61c591fb78f433a77b88c9774989095ec29a9a844ff2264001b430 2399572 dovecot-core_2.4.1+dfsg1-6+deb13u7_armel.deb
 50abfe63a17227bc8829af7c47cb687688be80f3ea3344e19f402666044aa44a 434156 dovecot-dev_2.4.1+dfsg1-6+deb13u7_armel.deb
 7c4549b1105f3fced5dd755ec5be44ba9baf884586d1ad29ec67a1b562db4bff 185020 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 9dcd31e805c334c4dcfbad7d7084abc00e2e2e3e0fad3a63003c68b245b8ef53 39744 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_armel.deb
 d64a24eb8fea7beb3f43c45daebafcf16e8963dd37768171a250cb47a40db420 21356 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 90e2e0b1a5cf8391dfff441db00bf851295e9459c749e14618a2b9891ef2ce56 18968 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_armel.deb
 292af3f26f96ab9ec7f64daf69b3611fed8a483607c88acea005aff8b8ac5ef2 727456 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 a8798b339cecb654232321d643aa541e9faee94ae4e85f6cc8e2485d62c66cc4 174528 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_armel.deb
 8c757ab837b0350aafa167c66f0eff7de5215398830e66749f337f5a8e33532d 163988 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 ee2a531c2681a0a79765f344359cbc756770c6318d03c086a92981698f6ea5ea 49728 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_armel.deb
 5026ec628142d10d970063d37489ae4b505f6811394752363032b64d521f8b36 99756 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 7c8226462c31b019e01fbba183628b7e40e424530cc041a39492385ce5472d40 35608 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_armel.deb
 01cfd91b7c244947bb29b9ee9c5a46f2f10e0ee46c61bd888039725667485b0d 115964 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 9fc25e81d3b74f3eba3e5c4be8f3265875b61b0f4aa47526c817d2d48926d527 45632 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_armel.deb
 b1881587809470881cdb942f5b05290fca9bc9dfcfd23a1346ab909450b3594b 35528 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 06c3e23b7bc0229307b1f10ec32dbe258e8ec05699f1695193e592ea4cba4ff4 20928 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_armel.deb
 0c425e8248253fedbfcc64d92a056095af6a047da4046e1a1253c44b6aaad998 39072 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 bf977aa31c81c266668c70aa68158c524903fd170922896ff11bd78538abd17a 24936 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_armel.deb
 4713967894e60554fc8309bf7f8c443fc648f35d34e1d9c00f1acfebb37fd580 101916 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 88e21248da7332d08fb4d795688171c03e619d28104121b3f3f9df8302ef1fcd 42912 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_armel.deb
 baefb64ab3e6ae31da56cd35659981f5f9a169d5ef5c745e23440aba1cfa2147 1661024 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 6a7da9a159c111bf1254e2e512a5f4bb4eb7dfed8eb8b18b12a4ef7f756b28d5 333920 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_armel.deb
 05aba7752f407d23c3373b4d9a85fa90dd01219c6d5c913d23b6ad731d3e9ea7 73760 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 3f178f95e34064f44697db598b29034e10b00f198f5622326dc961219a188df8 37684 dovecot-solr_2.4.1+dfsg1-6+deb13u7_armel.deb
 ac4c87cf007ad80fc6970c9dd7c677c08ea44d3765b03647132c667dd853c5ad 25036 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 8246d582ce99c62319243452f7fe78672222e91e8d5c5295027c5b4abd2691ae 20308 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_armel.deb
 ac27d728095e614a4a8029126dfbdc5c9d0f8943fb78cec6da0747bea472374f 205704 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 0ac642484b7f140f19fd89ca929b70c25a3dbe078dd0b7180433b2b7909f7101 56764 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_armel.deb
 5da9418d694329f7dd38e16acd5b56d10f53b613afc14d79d6bb619ff1a77ddb 18108 dovecot_2.4.1+dfsg1-6+deb13u7_armel-buildd.buildinfo
Files:
 d2757b28595e7ea29763e13ce4b7f070 31988 debug optional dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 56e96d80a9497aae669277585a93b5a4 22564 mail optional dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_armel.deb
 42028099400c41cdbb4e026b800a2d9a 9726044 debug optional dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 f3990167a3f037a02158717758f91119 2399572 mail optional dovecot-core_2.4.1+dfsg1-6+deb13u7_armel.deb
 1fd2d0df71a9c1eb4fd69040a910f5ec 434156 mail optional dovecot-dev_2.4.1+dfsg1-6+deb13u7_armel.deb
 43d9810b7fa2579d7d7bc756b40f8e55 185020 debug optional dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 fd7ba1f60fe028389981236bd2b9fc35 39744 mail optional dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_armel.deb
 f4a6297f64ccc7bd86f4bdaf1687ca0b 21356 debug optional dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 65d4428caec4fd29b8e4cdd7b37d6833 18968 mail optional dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_armel.deb
 baa2519be4dca7a95821806bd9f7338b 727456 debug optional dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 d38ab4575a67d5e80599a0acb5a4304b 174528 mail optional dovecot-imapd_2.4.1+dfsg1-6+deb13u7_armel.deb
 636f40d94064990c9b3815f4ebcc58d8 163988 debug optional dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 20d5e859b16e72e754726b8d39809a2c 49728 mail optional dovecot-ldap_2.4.1+dfsg1-6+deb13u7_armel.deb
 bea3fd906ed29282abd63b9addca778c 99756 debug optional dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 a7f5b8798ffb2399e5abf0bfbe8e3865 35608 mail optional dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_armel.deb
 0ad83a28e75c17f8fd92de4bdbfa84b0 115964 debug optional dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 fd0b1a931467994acb3d05f248d2d927 45632 mail optional dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_armel.deb
 0758ad37bc7348c68c5e378520854947 35528 debug optional dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 706621c4407136ee064c46500fa3bd2e 20928 mail optional dovecot-mysql_2.4.1+dfsg1-6+deb13u7_armel.deb
 e4b2888dce31d2e38a15a118ac2ccd28 39072 debug optional dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 63b69b7e91e865c0aed4e3bb75e0d611 24936 mail optional dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_armel.deb
 3d3c3728fbdcc8091e8db78cc567d95b 101916 debug optional dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 e86dbcb1d8c61dd31800224ca3136e01 42912 mail optional dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_armel.deb
 572e90dda39f78aca0859914953c9eed 1661024 debug optional dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 cd9edbf83fb10f61e5da58c09471e832 333920 mail optional dovecot-sieve_2.4.1+dfsg1-6+deb13u7_armel.deb
 d9a86c8ce4df18bad49f94129ce6fc3a 73760 debug optional dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 af59f3cd99da9a73008edd057f999ed3 37684 mail optional dovecot-solr_2.4.1+dfsg1-6+deb13u7_armel.deb
 5a45997e4046fbb2613b274a14dfea56 25036 debug optional dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 67b8709cb437a62cc0f0b56f821033c9 20308 mail optional dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_armel.deb
 412cb211665c939bba7f8e75e3c50ff1 205704 debug optional dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_armel.deb
 ee07f3148fd320ef27fc7ba771c77824 56764 mail optional dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_armel.deb
 cbc9c8e9fd733b4db1e90c206f36bec4 18108 mail optional dovecot_2.4.1+dfsg1-6+deb13u7_armel-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0Ha//LlsGOpbQ/H4xqCFmsOWgoYFAmq5IzoACgkQxqCFmsOW
goZfFA/+P25EUI+6HPbwkjPzSy2qOP0ta8hDTD318ymMCOmJo3Iu/I5dZWM1ohgj
mDKePxR8oDwXnqjNUNH4w7io5AHE/eEFZZCspmaSgmV5cuOfxSYHsMer668G+Y1d
QbpaRAs0+1hcpdrmhwG8TQ9VCTWg4k1XcDYOY8/ZUjpNFxYSdfGvVr8qLlFT1s9D
VBsL6VU95TwWCEKkQrMVEzNVf+oVkuD3lfEGem8fsruESb8Mjrr3fm4Yk2xXrYId
7IZ+0+yXG+Tw7q0ya9E9Ck+hrOJNldOPrnTRvDyzoHMwSnToqzMgSXo2otfGBYUX
sLasYvM1G0XqSvLgafYpMhjS2Q1cbzy0euEJ05r+rr0nWcCypDdcPLlv2HSCdBDR
SoZecLv4niRThleXi3SIvA+bYabknwYL2thUofrOetmbeNazgEOrjuhsFQOImTgw
ayl1JDikufTOJXJGaGlQ69OXWsTKd3eLZuFjMD1cbRTQHMK9AB64/byLhRZe/DRO
c0EEe9vSBtU1fevfxVHkt9rGb1vK6hWFqh5sO5n6Zs8tgcHlCMi6gsHkqMUkIfTq
rPgLgjZOOqHb5PIJ1qc9J2xxM1zWN3pRKwQ4oNL6hcVuwGw7uPfNGpO8CgfnkxCg
4PXu9J64wLGHEm9KpPAxailE1tQC+oiPn/nXuMfd6EpgFB7xAdo=
=R2Wv
-----END PGP SIGNATURE-----