-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 16 Sep 2026 15:06:35 -0400 Source: dovecot Binary: dovecot-auth-lua dovecot-auth-lua-dbgsym dovecot-core dovecot-core-dbgsym dovecot-dev dovecot-flatcurve dovecot-flatcurve-dbgsym dovecot-gssapi dovecot-gssapi-dbgsym dovecot-imapd dovecot-imapd-dbgsym dovecot-ldap dovecot-ldap-dbgsym dovecot-lmtpd dovecot-lmtpd-dbgsym dovecot-managesieved dovecot-managesieved-dbgsym dovecot-mysql dovecot-mysql-dbgsym dovecot-pgsql dovecot-pgsql-dbgsym dovecot-pop3d dovecot-pop3d-dbgsym dovecot-sieve dovecot-sieve-dbgsym dovecot-solr dovecot-solr-dbgsym dovecot-sqlite dovecot-sqlite-dbgsym dovecot-submissiond dovecot-submissiond-dbgsym Architecture: riscv64 Version: 1:2.4.1+dfsg1-6+deb13u7 Distribution: trixie-security Urgency: medium Maintainer: riscv64 Build Daemon (rv-osuosl-02) Changed-By: Noah Meyerhans Description: dovecot-auth-lua - secure POP3/IMAP server - Lua authentication plugin dovecot-core - secure POP3/IMAP server - core files dovecot-dev - secure POP3/IMAP server - header files dovecot-flatcurve - secure POP3/IMAP server - Flatcurve support dovecot-gssapi - secure POP3/IMAP server - GSSAPI support dovecot-imapd - secure POP3/IMAP server - IMAP daemon dovecot-ldap - secure POP3/IMAP server - LDAP support dovecot-lmtpd - secure POP3/IMAP server - LMTP server dovecot-managesieved - secure POP3/IMAP server - ManageSieve server dovecot-mysql - secure POP3/IMAP server - MySQL support dovecot-pgsql - secure POP3/IMAP server - PostgreSQL support dovecot-pop3d - secure POP3/IMAP server - POP3 daemon dovecot-sieve - secure POP3/IMAP server - Sieve filters support dovecot-solr - secure POP3/IMAP server - Solr support dovecot-sqlite - secure POP3/IMAP server - SQLite support dovecot-submissiond - secure POP3/IMAP server - mail submission agent Closes: 1144639 1146018 Changes: dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium . * Import upstream fixes for multiple security issues. (Closes: #1146018) - CVE-2026-27852: DoS by sending mail with bad header - CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return - CVE-2026-33605: managesieve-login: Pre-auth crash - CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service - CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT - CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c) - CVE-2026-40015: imap-hibernate can be crashed - CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c) - CVE-2026-40018: MySQL multi-byte escaping wrong - CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl restrictions - CVE-2026-42007: Sieve editheader RCE - CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command - CVE-2026-42394: sieve: symlink traversal flaw could result in arbitrary file disclosure - CVE-2026-52681: Sieve resource usage tracking lost when active script changes - CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage - CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks - CVE-2026-33606: dsync: Mail content can cause dsync protocol injection - CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text - CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy - CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages - CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons - CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes - CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path - CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim * lib-mail: istream-header-filter - Fix potential assert-crash (Closes: #1144639) * CI: Disable test-build-twice job, which is known to fail on trixie Checksums-Sha1: 7e71a869f68bd762b73e3a8d16c0b8b6febb0c00 31288 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb a0b1fa4b0d51e0590637e562060bf9731c45afaf 22516 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_riscv64.deb 45b3dbae51bbccdb8ca80742cd6abb7650a8e6f2 10571628 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 73168cf13018b641d8535249cd6d66af971779c8 2706200 dovecot-core_2.4.1+dfsg1-6+deb13u7_riscv64.deb 8346cc0927e26f643fce0efb341af70ab6546469 434220 dovecot-dev_2.4.1+dfsg1-6+deb13u7_riscv64.deb ec8bbd3e937e171e3b522af2766e0e539f30e82a 172560 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 5e9aead1eba76611a061865ab18b08d75bd9e2a8 42752 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_riscv64.deb 1d47ae3fa2b521c71dc3baaacdaa4aa1557eef71 20612 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb e0f5201c41dfa639e13c4249bd8a540ce610c381 19264 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_riscv64.deb a92b4f2e6bfb58c7bcda89ad0bec967d11ca2302 788632 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb fc8e96f7a7819f308a970602033663c72dd9a313 197420 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_riscv64.deb dcbebaf3fff1676463fc98e3f0c2a487cdcb15c3 184020 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb dd62ba0c7a48e3211d170c19c75a1a63ac937ce4 53980 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_riscv64.deb da2ddb97c808edffdb6fcb187ee643d394e4fe7f 98924 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 6548ce8a463fe1b19f5e98a760a1a9a95dc0dadf 37368 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_riscv64.deb 8ac2881a71229919f5476da1b72a621869a030ba 122000 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 5398441c9f4d16bd6a3efa54242cdc91ace9d98e 48456 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_riscv64.deb 51f3354d1496765162d69322b5a95e77fe9d0705 34876 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb bfeba83491854e47336b7fc0c834133cf55b879d 21388 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_riscv64.deb 86ff238c90c8350d18f9513f4d9ad4aed2a7d04c 37460 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb b6a5c86b7edbf25e180fb8c7a5f896dfe86ca63b 25444 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_riscv64.deb 69395743ec0811ba197ba31150b801286a501ace 102568 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 6db63299a10d1285515591513b2ba66a1e71a9f4 45304 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_riscv64.deb a46ae0e225066fd6dc0d922bd245f932ef81c40e 1701884 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 383a653e46ddc5d69f476da2c37d7110508e153a 378140 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_riscv64.deb 62f6a4dc7378ed8d88dd174f9e7ec08e9a049c10 72504 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 2f41c9977f49bec729e704c1d13e3212099f40c3 38796 dovecot-solr_2.4.1+dfsg1-6+deb13u7_riscv64.deb 3d691e1368e8222567652d76cc8313932d3bfd13 23984 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb d5bd8ad11f61c77d34e1150fb3b073579be0dbee 20908 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_riscv64.deb 6fab0e13245377b8d12d6f3436e3d4da21bfcafa 206012 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb f277577bba6221f13078ff487cb6524557cbeba5 62080 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_riscv64.deb 7e10492ba0d31ad8e4675f7414620ac10ac77a5f 18377 dovecot_2.4.1+dfsg1-6+deb13u7_riscv64-buildd.buildinfo Checksums-Sha256: b5005f8b62292f8de6780305cf32c754fa4d50e1c07bbd7b382ec55e05fe3a3c 31288 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 3c3704dd4b9bc671409b7b8b4e9a5e373ccb6400a4d1da68a5e09e1807c0f2e4 22516 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_riscv64.deb 146af8ebed072b650c47884a464fcdaf23bf1fd7786f21c40e1906fec73deea4 10571628 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb aba03759188ed2924b635f5d3f8bafd0b24b99cecef67e74f8b18dab378552e6 2706200 dovecot-core_2.4.1+dfsg1-6+deb13u7_riscv64.deb 3a9faa97a9eb179535b7e0420bcee30bc3dbc02ad25870fc51b1f92f9a13c6ce 434220 dovecot-dev_2.4.1+dfsg1-6+deb13u7_riscv64.deb c5511884c6f6abbff68d1795ac2823e31163d76b9ee1ec2ab4763e70c04cb00e 172560 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 422e89aea28a8f330ac1bf5b58bdca763fd14cd7aca36720405321a085e2f62f 42752 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_riscv64.deb 41a1a20831d245f98c6359e5a272523dec8caaf55f7321bc6a9682d06ac86856 20612 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 29cf813b788ef796786234ad6220f7cffed137905259faf429e8c3f7b30ac809 19264 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_riscv64.deb 172a9240ed9f8859fc785721e40db0aa3f71e8553b42d1e91cb2741d05184cb7 788632 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 3d0a1e56afbf8cf6b23bb510d39e60c591f570affc9865ff30c266d99d1c7ba1 197420 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_riscv64.deb 1141c01d5f4201af70a028f29d344a0f78dee631cbc89fdee5b288a5b44591b1 184020 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 70f84a3c5828adae6558a8b64f9dca57a9c30c29f0c39880caade9658b453173 53980 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_riscv64.deb 4c1b66ffb7fbe5e8af3b20a84665982af2ce1e32310d1d9e17bf80f12dd207e0 98924 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 1d1ce27e2bc9ce227f7d35208b56e82d5824a37706c5046fdeb7c32e7c04329d 37368 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_riscv64.deb cd8a01bcc8fb50d77b65d67ec1f67358b1949edbe1bc4aa2f5ff87a67fd1da7f 122000 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 5606d75a18fc52c383a6475c88164ea779c6fe3e6aa1423e3358f42f6f1a818f 48456 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_riscv64.deb b63fdb2dbfb54c91de6b6dcc708fc0f6858024317cec538d7d6d9beba4097cd9 34876 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb eb9609dd1416af1e4b2dee0916b6c55924b131560007125e6debec7f40192d13 21388 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_riscv64.deb b47576ee9cdcf0b8e6137961fb1f60baac583c5146cec7fe91f0d2d4967a1f14 37460 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb b584fb021b7c296e7ef6db039187a6adec2dcbe62a6e01b915947bf90e6095e2 25444 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_riscv64.deb 858c3b722e1f684cac50799b25d35952d50b06a87b3368b46cc1aca2ad7f368a 102568 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 57314310e1b25d394ba3234926bb3a6c28b1adfb3133ed705c890da3bc30e332 45304 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_riscv64.deb 8ee4b2c048a4aa6e82ee5eca88960560a55dae3b8c4e37a4342f263d0e2060b9 1701884 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb f262fc294cc484d3ed3b5186950feda9fa247476d06a4aacb9294cb3f68a973b 378140 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_riscv64.deb 8b82d007ffcfe93a1c10c1bec7d9bc7a3f01c2ebfbbc2a664dbd61e09887368a 72504 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb f3bf1b9664afad46cf9d109d8b32f5b6e277b8eae734fafdaba049c781b68f7e 38796 dovecot-solr_2.4.1+dfsg1-6+deb13u7_riscv64.deb 51ad2694b76f67ed36f7b87baddcc3c7ca5e6d9f3665f90cc3620dca254beff7 23984 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 77b55ac96347e64fbeef29b32cf40c02843c39be25b1f6679c604d0c0c20f59a 20908 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_riscv64.deb d5197c16cf40bfb302478131890d35765ee3892af020b1f1d037e5394f15cb4b 206012 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 1de566681a8cb2ee139df547922cc663302220c774712defdab050b26951509d 62080 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_riscv64.deb 19f39c84912bf202560b07860b83d9f7b9a5803aa26997249bde2ba1a8938f61 18377 dovecot_2.4.1+dfsg1-6+deb13u7_riscv64-buildd.buildinfo Files: 1995fc343b1b3547395387557f8389e5 31288 debug optional dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 029b1fc1e052d807728bbe2623b63bd9 22516 mail optional dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_riscv64.deb 5003d7ee8cac722fb2f7f04fb55436d1 10571628 debug optional dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 80ffc2791aeb02e2a48198d20fba8672 2706200 mail optional dovecot-core_2.4.1+dfsg1-6+deb13u7_riscv64.deb 62eb8764b116d166376cc885c1253f3c 434220 mail optional dovecot-dev_2.4.1+dfsg1-6+deb13u7_riscv64.deb 4cabca376c4e522f964993f85c2fe776 172560 debug optional dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb aa339a3ad5241b1342fc9801de2ec7d5 42752 mail optional dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_riscv64.deb 4c8d90e646741153dac85c42cd1a3343 20612 debug optional dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb c513084e940fe9c87e6cbba2b76ec82d 19264 mail optional dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_riscv64.deb 32f400b5a1b2affbdafa3d477b48fa52 788632 debug optional dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb f2443039e02c8247bdae1be173b55912 197420 mail optional dovecot-imapd_2.4.1+dfsg1-6+deb13u7_riscv64.deb 9146ea7b65e53c1819b34650e81d658e 184020 debug optional dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb adb87246b09a938d456bfcd5c4004a4f 53980 mail optional dovecot-ldap_2.4.1+dfsg1-6+deb13u7_riscv64.deb 4d35eb85ad92f2355441a32cd766bb9c 98924 debug optional dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 3cb22cb56ecf262f172bca48507f69e2 37368 mail optional dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_riscv64.deb b1c9f0967f708ff41fdb19363dbb1086 122000 debug optional dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 09a9c718c503c02ecdaf0a2f5e815357 48456 mail optional dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_riscv64.deb 6bcea2837ffe708f7e957bf1dcf4e628 34876 debug optional dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb ad8c487be479cdd51cb02f688958f79d 21388 mail optional dovecot-mysql_2.4.1+dfsg1-6+deb13u7_riscv64.deb 50235d16b78c5e984cba072b18341922 37460 debug optional dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 5637a8ae237068e6bc6ba4b166bd6a4e 25444 mail optional dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_riscv64.deb 977f6d770dc32ba8b8aa3d8989dc208e 102568 debug optional dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb b339a9c6a9ed4f988695faa038d0d97f 45304 mail optional dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_riscv64.deb 1809f5faaa0f01c3818b9acc5a442439 1701884 debug optional dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb a398246ff8a5e6651e648f31e5fc7db1 378140 mail optional dovecot-sieve_2.4.1+dfsg1-6+deb13u7_riscv64.deb d6c5727fbac7e69ee650cfb66436f4ea 72504 debug optional dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 840980370970a18124bd62745e4d031c 38796 mail optional dovecot-solr_2.4.1+dfsg1-6+deb13u7_riscv64.deb 7cf0673f0fc832d07076e4e29ea16996 23984 debug optional dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb 834e392b625a799d6583ae00acfe059a 20908 mail optional dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_riscv64.deb 4c5aa59502c4268a24341491814e0a22 206012 debug optional dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_riscv64.deb c2a1f32b1be543d78ada8062b484b188 62080 mail optional dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_riscv64.deb 2c0792e1bc90aba247b479c5972273d6 18377 mail optional dovecot_2.4.1+dfsg1-6+deb13u7_riscv64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE/AxPdLOtOshqz3vw/Fc5EAGpa+sFAmq5TesACgkQ/Fc5EAGp a+tIkw//ftnL7e0c+K0Alp+ipYYZwwt95hpm+/hfGAJXMyifMepIfK7o5Lx/O0Ne lKHcqe4YK9t9IXudpw/+iAGBFbZHle8sWGdeob6UiIo23tMX7+TfwFW0X4tPzu/K bu2G1aFoDa0vQQ3vO4w6QWBm5eCG3AM5vxF6MbbR66pVZuKFlaptDR0BoaH8b3fx hTNWZfbSat+GvxXFc+qIDQTgCJVOyC1DunBKIvYYYKpADeUk194GC7sjRXgaL/hR Fbw/HjwA30mmY1TzXIY/X3SMvmmx24JhiWTAV2EzflM9jsOjVRLhSwCioKHujicv rJXrpW8pH9Z4tQiUiYw+QJuTXr6CDQkZQvis9WFmiOW6F2BrKS2JRWbWCl43ixR2 pptlOrZ5USzRGs8J2jHA54p7bj7khg0n2fw1Bp8ryrVCalqpBwfL0OEYCJ8oMWZa r/6U0ofGrvrcBBEaVfjcBgwTK5XEvODMx2X+NFs+7wwqnR5uH2FZ+mMRICxz+oIO bgwBBGeI3re/CmhwjBmrMKhsdshld3axKBLOAc8XDzZoH3pjgVtRdmTxytVdPtZ4 h7VGo8yH6kPfXR+lRpaUK+5H/CB0jSyaFuizykCMbN5uoiqcAG/PeoY/NWWPfeS4 xwbdjxLq62djgixDWtQTNfN8B70cqdIGLa2xMKpawEh87cXrVKM= =/glU -----END PGP SIGNATURE-----