-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 16 Sep 2026 15:06:35 -0400
Source: dovecot
Binary: dovecot-auth-lua dovecot-auth-lua-dbgsym dovecot-core dovecot-core-dbgsym dovecot-dev dovecot-flatcurve dovecot-flatcurve-dbgsym dovecot-gssapi dovecot-gssapi-dbgsym dovecot-imapd dovecot-imapd-dbgsym dovecot-ldap dovecot-ldap-dbgsym dovecot-lmtpd dovecot-lmtpd-dbgsym dovecot-managesieved dovecot-managesieved-dbgsym dovecot-mysql dovecot-mysql-dbgsym dovecot-pgsql dovecot-pgsql-dbgsym dovecot-pop3d dovecot-pop3d-dbgsym dovecot-sieve dovecot-sieve-dbgsym dovecot-solr dovecot-solr-dbgsym dovecot-sqlite dovecot-sqlite-dbgsym dovecot-submissiond dovecot-submissiond-dbgsym
Architecture: i386
Version: 1:2.4.1+dfsg1-6+deb13u7
Distribution: trixie-security
Urgency: medium
Maintainer: amd64 / i386 Build Daemon (x86-ubc-01) <buildd_amd64-x86-ubc-01@buildd.debian.org>
Changed-By: Noah Meyerhans <noahm@debian.org>
Description:
 dovecot-auth-lua - secure POP3/IMAP server - Lua authentication plugin
 dovecot-core - secure POP3/IMAP server - core files
 dovecot-dev - secure POP3/IMAP server - header files
 dovecot-flatcurve - secure POP3/IMAP server - Flatcurve support
 dovecot-gssapi - secure POP3/IMAP server - GSSAPI support
 dovecot-imapd - secure POP3/IMAP server - IMAP daemon
 dovecot-ldap - secure POP3/IMAP server - LDAP support
 dovecot-lmtpd - secure POP3/IMAP server - LMTP server
 dovecot-managesieved - secure POP3/IMAP server - ManageSieve server
 dovecot-mysql - secure POP3/IMAP server - MySQL support
 dovecot-pgsql - secure POP3/IMAP server - PostgreSQL support
 dovecot-pop3d - secure POP3/IMAP server - POP3 daemon
 dovecot-sieve - secure POP3/IMAP server - Sieve filters support
 dovecot-solr - secure POP3/IMAP server - Solr support
 dovecot-sqlite - secure POP3/IMAP server - SQLite support
 dovecot-submissiond - secure POP3/IMAP server - mail submission agent
Closes: 1144639 1146018
Changes:
 dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium
 .
   * Import upstream fixes for multiple security issues. (Closes: #1146018)
     - CVE-2026-27852: DoS by sending mail with bad header
     - CVE-2026-33263: submission-login: Panic when
       mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8)
       failed: Bad file descriptor
     - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare
       Carriage Return
     - CVE-2026-33605: managesieve-login: Pre-auth crash
     - CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential
       Backtracking — CPU Denial of Service
     - CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole
       ManageSieve CHECKSCRIPT/PUTSCRIPT
     - CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted
       References Header (index-thread-links.c)
     - CVE-2026-40015: imap-hibernate can be crashed
     - CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision
       in strmap (mail-index-strmap.c / hash2.c)
     - CVE-2026-40018: MySQL multi-byte escaping wrong
     - CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl
       restrictions
     - CVE-2026-42007: Sieve editheader RCE
     - CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command
     - CVE-2026-42394: sieve: symlink traversal flaw could result in
       arbitrary file disclosure
     - CVE-2026-52681: Sieve resource usage tracking lost when active
       script changes
     - CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage
     - CVE-2026-73209: imap-login crash: Self-recursion on zero-output
       decompress chunks
     - CVE-2026-33606: dsync: Mail content can cause dsync protocol
       injection
     - CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced
       Email Body Matches Sender-Chosen Text
     - CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows
       nopassword injection via trusted proxy
     - CVE-2026-42392: imap-urlauth leaks memory into user-visible error
       messages
     - CVE-2026-42393: doveadm_password or api key length can still be
       leaked with timing comparisons
     - CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes
     - CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR
       semantics in remote validation path
     - CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for
       missing scope claim
   * lib-mail: istream-header-filter - Fix potential assert-crash
     (Closes: #1144639)
   * CI: Disable test-build-twice job, which is known to fail on trixie
Checksums-Sha1:
 d4b1fa5a9c1dded3a929778754247a460efb6f29 29012 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 5371770e299c948c75d48bd4b1a00e2434fc8308 24048 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_i386.deb
 e42ceb373cbb0e38030faac97b0b376e48e310a6 9916728 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 5071838c88d3148edc580a5e1e6e1a96f62164f5 2954320 dovecot-core_2.4.1+dfsg1-6+deb13u7_i386.deb
 d276eb4da489738943e7acdb267e6f8b4d1dbf87 434164 dovecot-dev_2.4.1+dfsg1-6+deb13u7_i386.deb
 71e9470f9e8248cbfd690512b3605011c20a62ce 183248 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 d3ff9182c467e68ab653f4312467c78749fba174 47388 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_i386.deb
 793a58aa7def4f4e2abe1ba11fcf83f87a597dbf 19636 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 c1dd400190de8d5b460d0c45ad59a4a0a359f52f 19840 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_i386.deb
 1197aad3dd4d3eef3ac2c659407f1257a72c21b1 750520 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 302cdd49721db8f9a671a39cef989bc84d16a10c 218532 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_i386.deb
 ff68e091db07474ad209aaa8982623b460b23d76 175568 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 58abe33d91132af53165f11d7fcdd77818e9f46b 58936 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_i386.deb
 6e95634355fbad86a4a62f4f1141fdce8287d200 93880 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 ba5f3e7f94aa84776f7e481ee4d52b116e82805a 40168 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_i386.deb
 887ee13deb10f7632c05b2b055ee3d7bc876127b 113124 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 96cb0538baf3c33cf88d30b3236bde1ec2ddbab9 52300 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_i386.deb
 a91a8e88043ba88e63a8c42a06e23f6f8052a8e1 33176 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 4b52adfcaf4276c5dc6a5b08a7afddc9b58a197b 22536 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_i386.deb
 8fd979593372d2be699ddd926773fa5b57452024 35200 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 5e3b8866ccc56cc6668803ed68d3d661a84e5160 27844 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_i386.deb
 6e4838ca23fb58924a83521ebe15031bbc0df519 97980 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 eb043ed680bee095348391d8865b3eca4a720dd8 49216 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_i386.deb
 3f0c35e935de1a0e0707515c2853e9f9b13c7751 1582912 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 c0a6d358544dc7c5ea08821dea9e4e330d388aed 415880 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_i386.deb
 bbd7f54658a87b83c4d5472eca44492ec655b8fb 69188 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 47fad4f2e00cb457e4758406df494eeb39933333 40416 dovecot-solr_2.4.1+dfsg1-6+deb13u7_i386.deb
 7913226696480d7f9e62a4a6e7caf30bbb726fff 22268 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 f27692717b505a57b9d95db832f854c01bddcef6 21564 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_i386.deb
 05b7dab02d83be6e1d249639bb1a5fa525f1163c 193880 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 5c918d4d3751ebe6fb6e951020c53d2baf9b933d 67256 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_i386.deb
 8d27862b03fd74a4b2c96556a7610cb643cc340d 18067 dovecot_2.4.1+dfsg1-6+deb13u7_i386-buildd.buildinfo
Checksums-Sha256:
 2ea5da12229017488da0fd8b522a4b02e8be398d0d0b002d65106c91bbf36158 29012 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 7edd4316f6f0ca3091090824b0c4239c2e9cacaf42b52c4d0acbfd60d3b4b662 24048 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_i386.deb
 b546f40335b469cf593734a7e99bb557b07c80d862544535254ca61bc4456742 9916728 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 a54368ec8022709e328ce73b4ecb420d889ad50c3a86963dc231ae29ef32e5ff 2954320 dovecot-core_2.4.1+dfsg1-6+deb13u7_i386.deb
 8037c7879c26d4f2be82ec456460838e0e68e3067613d209b60288697c539ffd 434164 dovecot-dev_2.4.1+dfsg1-6+deb13u7_i386.deb
 41aa266e5823e62d9965cbecea8091bfcfeea0b9f9bbed023dd44779b5f71ea8 183248 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 68896765a197bbf57df86966b736bd320fa39bc696d47e0d395181c7b187662a 47388 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_i386.deb
 41e1a048bb20203bcec2bb793e8249c26821f5f15d77af83d16462b97eab06df 19636 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 da1e91a963153f03378c9e017311f1e858301093695b95f8c12498a3474dc882 19840 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_i386.deb
 27f6f0dd1c64c6a436cb6742073f508a32be5780516762fa12d5aed722e3af87 750520 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 f07482d66a1df09e0c071682881e5c94c8f61c79ffb60ecf19fc2bcf376f3fa5 218532 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_i386.deb
 6322a532edb483f5ba47b138b9123ac9dd08ce67cb6b2ee14ff463a53dc7cbd0 175568 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 c4cb544bf67eeb20e6ef760a66c3a2343e708dc4438d9da94ae2df7b78364b6f 58936 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_i386.deb
 c6211111266a8306be3e61ddd0f5b9acde849f65617ad5156f70ab40d18e8fd3 93880 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 155a7aa2ef954193d8f6adb7a2a11d1a7e0149e961372208b97d6bf0fb0cbdde 40168 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_i386.deb
 ad983ff54495bbaeb02b2d6e4290d78c8c66e4ea92f786b06b268d6edb162b16 113124 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 23c58c3070044d749fd28d6290d586f987ac47a147ce455517dabc5b09bce657 52300 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_i386.deb
 3780fc06a60cc71409383fb84fb75f3f58ffb3286652cdbbf0082cdf6ebb169b 33176 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 ba755f7eb7a538323b446035035c56437b2bd96405f29b0074ea9f81e33743b8 22536 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_i386.deb
 20eafc6eef63da8fbe3c1b2547634dd349d57281b494e89a604a90fd78dae636 35200 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 772ad3242de6acc96a2f16b1f88d5a32c84c14dfbc68ee07151ae54f45efeb8e 27844 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_i386.deb
 55a1bd44d15a53962a7c2a7f82f0137fe48405c5d01dda54499b682d1cc8bedf 97980 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 e8b070e05a4a12c0aab7f8c0a3a9218ffc46db65d38f5064bc8655e771345cb0 49216 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_i386.deb
 f5be8754c0382d48e845b9d4433369ef11ea1cbe25efc95272511e9da840c303 1582912 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 d82cbf2ae718ba72367f6131d43de26013c3f160003fa29d8e234a226c260da2 415880 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_i386.deb
 dfb70f56b7fcdadf41c2cf238843ed6161a0834b2ada06a934378289c1b0e6cd 69188 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 4ec552166dfb83a1e96b3c4d6f799ca4bbb80e059ee625ff69f16c9423964666 40416 dovecot-solr_2.4.1+dfsg1-6+deb13u7_i386.deb
 4f90b2dd14c366918772dc7ee9e0d9aa2e7ee67e7f13d2d05c25238a2a89f1ae 22268 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 2bbfebc3b1070b0432302dc54aaaab01debb5d571cc0ba6314725e2c0efccb5a 21564 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_i386.deb
 4928dc504cca2ca66b89e864fd71f6a2e0f2026411e7a3494d6df9375dbf82e3 193880 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 6ae77e52916bff0548ddd925c561cc2e41293e761507fc0705f267cd1b6230a4 67256 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_i386.deb
 dacf022b5e8c9245ec6580b707d13053c70ebcd427472a02ab8096b67beba871 18067 dovecot_2.4.1+dfsg1-6+deb13u7_i386-buildd.buildinfo
Files:
 d7d89eaddffd8fcaa6d204ab557fc9b9 29012 debug optional dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 14db410b100d1c050c86ccf728e706df 24048 mail optional dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_i386.deb
 6b77b8af9c5592f5fbdbf3de3fcd43b9 9916728 debug optional dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 bed91689bb2abe53316c2e73ca4e7540 2954320 mail optional dovecot-core_2.4.1+dfsg1-6+deb13u7_i386.deb
 cfb988110d5007e271063bbf89060cf9 434164 mail optional dovecot-dev_2.4.1+dfsg1-6+deb13u7_i386.deb
 d9afbd82ed4762082c67c0f313862af9 183248 debug optional dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 8e376fe4f02b333b6d96cd76068c4c5c 47388 mail optional dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_i386.deb
 c482aef1d1ff6cc216ea6f4208c7494d 19636 debug optional dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 8ed08bcc0d241b69cf2412852e949dd4 19840 mail optional dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_i386.deb
 9cd28c7d1c55bd4c488292c3eebfd58f 750520 debug optional dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 6710e364bb3aa4f766e313b7a6beb46a 218532 mail optional dovecot-imapd_2.4.1+dfsg1-6+deb13u7_i386.deb
 b4ee2e351484b8984856afdda487d012 175568 debug optional dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 bc66f9451ad6d6b7b43dae4237800ae4 58936 mail optional dovecot-ldap_2.4.1+dfsg1-6+deb13u7_i386.deb
 3021a79490e14293100fe1b5440b9ae2 93880 debug optional dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 f6f0c08cc80f57af9043a4f91598b892 40168 mail optional dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_i386.deb
 b5ae96f12b5602a7e21d58b8ee25cad8 113124 debug optional dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 6d504a609c114b7929b4147254e9ec27 52300 mail optional dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_i386.deb
 2aa2e730ea34927c56ec31878d6d654c 33176 debug optional dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 4547273b724d4c53d86d83accf451caf 22536 mail optional dovecot-mysql_2.4.1+dfsg1-6+deb13u7_i386.deb
 488487d07469acf68024941965ef8241 35200 debug optional dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 feb1041ce61fbaee624f5c6cf3dce5b4 27844 mail optional dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_i386.deb
 1e0789914bd95efce9bffcf4644b888e 97980 debug optional dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 4de305451acf8d3bb6fd71376f27a60a 49216 mail optional dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_i386.deb
 cac41e368529eea85b512724607a0f8b 1582912 debug optional dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 1642638fe32600816cd7bf6619bd8e75 415880 mail optional dovecot-sieve_2.4.1+dfsg1-6+deb13u7_i386.deb
 a87444325abc9d31e93f63cea5e5f426 69188 debug optional dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 64fcf657d5611791a9fbf941e5202cfe 40416 mail optional dovecot-solr_2.4.1+dfsg1-6+deb13u7_i386.deb
 a54b8808e9c40a484269f7d45318677d 22268 debug optional dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 f4c6f2a1474efd0c3d8535f9100f6852 21564 mail optional dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_i386.deb
 7b4174ae517c6e6b676cf163329ad919 193880 debug optional dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_i386.deb
 32d59d546d33c3fa36d4e78d803def41 67256 mail optional dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_i386.deb
 11e3bcc5b767447f6515fa365cc86817 18067 mail optional dovecot_2.4.1+dfsg1-6+deb13u7_i386-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmtr4KUMaso2EQ6NrTwt/65ON6zcFAmq5I0AACgkQTwt/65ON
6zdSSQ//WDWW0WJ44KsE7yHNQ8/belqFpsdSkBgMpafKvlfp2xsUm8QXcuN8WIcZ
Umqyyv7LjSkoiBibLM8IydNNNNbErdQZ8601GcSELHfgR7A0HYNo5HDGzsAjA+BN
60rkoGANyf0GO3yApxAhcfJmuHoJT9F7Q9QtyeRJH0mFJFngC9LPQXuLQ0WDW8EV
0oRleittb4jRQNqoBD04nhPQI07ZiQfesZt4TNQTJpwbLafxefb9OC4+tPa/xXEk
qIqMcx/IdL/4qz87wc1p/Cx2zY+j8q2eEpKbBibsLHF/M95XxJylH9fpremcCnmX
KEc+LqoADpRDBedeYU28HN8ldBE8JjImVI48BTqIqksGWj5UnN/KmyqIohNTCbe3
5p6knSUYnTdscNue1v83VKgVADqqwcQ0Jr6fRE+IiFHb76QXOmuQ/mWaWbGBbJKV
xJ/v3YAccUXSFiZxkAjsIJxY2rVETEMqYUdts+FufyThbMFd/wAuSRslndo0Fxut
KgJaSMi9FVtZnzUJMqgXTpa93okH/cARWeXFOGqkCjUFgdTyKLcBGwEQNKC1KZao
g670jnshqOMrFo9/Ix+6QMWKL1i1Z+uDNtgFbhhzYtGdMM82nBLi2MCkl2MAb36L
McDLlT+gks0nHgNuiDZa+slWqGtYj0P1d+yw5vodPXYhbOpCUdU=
=NELe
-----END PGP SIGNATURE-----