{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-33605: fix pre-auth managesieve-login DoS on a lone CR and\n unterminated lines\n- CVE-2026-42391: limit the ID key/value pairs accounted before login\n- CVE-2026-40018: fail MySQL escaping instead of falling back to\n charset-unaware escaping", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793089374", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793089374" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2026/clsa-2026_1793089374.json" } ], "tracking": { "current_release_date": "2026-10-30T01:56:33Z", "generator": { "date": "2026-10-30T01:56:33Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1793089374", "initial_release_date": "2026-10-27T08:22:56Z", "revision_history": [ { "date": "2026-10-27T08:22:56Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-30T01:56:33Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "dovecot: Fix of 3 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product": { "name": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_id": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot@2.2.36-8.0.3.el7.tuxcare.els4?arch=aarch64&epoch=1" } } }, { "category": "product_version", "name": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product": { "name": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_id": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-pgsql@2.2.36-8.0.3.el7.tuxcare.els4?arch=aarch64&epoch=1" } } }, { "category": "product_version", "name": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product": { "name": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_id": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-pigeonhole@2.2.36-8.0.3.el7.tuxcare.els4?arch=aarch64&epoch=1" } } }, { "category": "product_version", "name": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product": { "name": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_id": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-mysql@2.2.36-8.0.3.el7.tuxcare.els4?arch=aarch64&epoch=1" } } }, { "category": "product_version", "name": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product": { "name": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_id": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-devel@2.2.36-8.0.3.el7.tuxcare.els4?arch=aarch64&epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product": { "name": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_id": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot@2.2.36-8.0.3.el7.tuxcare.els4?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product": { "name": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_id": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-pgsql@2.2.36-8.0.3.el7.tuxcare.els4?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product": { "name": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_id": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-pigeonhole@2.2.36-8.0.3.el7.tuxcare.els4?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product": { "name": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_id": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-mysql@2.2.36-8.0.3.el7.tuxcare.els4?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product": { "name": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_id": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-devel@2.2.36-8.0.3.el7.tuxcare.els4?arch=i686&epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product": { "name": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_id": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot@2.2.36-8.0.3.el7.tuxcare.els4?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product": { "name": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_id": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-pgsql@2.2.36-8.0.3.el7.tuxcare.els4?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product": { "name": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_id": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-pigeonhole@2.2.36-8.0.3.el7.tuxcare.els4?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product": { "name": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_id": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-mysql@2.2.36-8.0.3.el7.tuxcare.els4?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product": { "name": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_id": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/dovecot-devel@2.2.36-8.0.3.el7.tuxcare.els4?arch=x86_64&epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64" }, "product_reference": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686" }, "product_reference": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" }, "product_reference": "dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686" }, "product_reference": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64" }, "product_reference": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" }, "product_reference": "dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" }, "product_reference": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64" }, "product_reference": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686" }, "product_reference": "dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" }, "product_reference": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64" }, "product_reference": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686" }, "product_reference": "dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64" }, "product_reference": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686" }, "product_reference": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" }, "product_reference": "dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-33605", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-33605" }, { "category": "external", "summary": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json", "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json" } ], "release_date": "2026-08-28T12:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T08:22:56.167073Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793089374", "product_ids": [ "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793089374" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-40018", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "notes": [ { "category": "description", "text": "None None None No publicly available exploits are known.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-40018" }, { "category": "external", "summary": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json", "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json" } ], "release_date": "2026-08-28T12:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T08:22:56.167073Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793089374", "product_ids": [ "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793089374" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-42391", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-42391" }, { "category": "external", "summary": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json", "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json" } ], "release_date": "2026-08-28T12:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T08:22:56.167073Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793089374", "product_ids": [ "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-devel-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-mysql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pgsql-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.aarch64", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.i686", "CentOS-7:dovecot-pigeonhole-1:2.2.36-8.0.3.el7.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793089374" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }