-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 16 Sep 2026 15:06:35 -0400 Source: dovecot Binary: dovecot-auth-lua dovecot-auth-lua-dbgsym dovecot-core dovecot-core-dbgsym dovecot-dev dovecot-flatcurve dovecot-flatcurve-dbgsym dovecot-gssapi dovecot-gssapi-dbgsym dovecot-imapd dovecot-imapd-dbgsym dovecot-ldap dovecot-ldap-dbgsym dovecot-lmtpd dovecot-lmtpd-dbgsym dovecot-managesieved dovecot-managesieved-dbgsym dovecot-mysql dovecot-mysql-dbgsym dovecot-pgsql dovecot-pgsql-dbgsym dovecot-pop3d dovecot-pop3d-dbgsym dovecot-sieve dovecot-sieve-dbgsym dovecot-solr dovecot-solr-dbgsym dovecot-sqlite dovecot-sqlite-dbgsym dovecot-submissiond dovecot-submissiond-dbgsym Architecture: armhf Version: 1:2.4.1+dfsg1-6+deb13u7 Distribution: trixie-security Urgency: medium Maintainer: armhf Build Daemon (arm-ubc-05) Changed-By: Noah Meyerhans Description: dovecot-auth-lua - secure POP3/IMAP server - Lua authentication plugin dovecot-core - secure POP3/IMAP server - core files dovecot-dev - secure POP3/IMAP server - header files dovecot-flatcurve - secure POP3/IMAP server - Flatcurve support dovecot-gssapi - secure POP3/IMAP server - GSSAPI support dovecot-imapd - secure POP3/IMAP server - IMAP daemon dovecot-ldap - secure POP3/IMAP server - LDAP support dovecot-lmtpd - secure POP3/IMAP server - LMTP server dovecot-managesieved - secure POP3/IMAP server - ManageSieve server dovecot-mysql - secure POP3/IMAP server - MySQL support dovecot-pgsql - secure POP3/IMAP server - PostgreSQL support dovecot-pop3d - secure POP3/IMAP server - POP3 daemon dovecot-sieve - secure POP3/IMAP server - Sieve filters support dovecot-solr - secure POP3/IMAP server - Solr support dovecot-sqlite - secure POP3/IMAP server - SQLite support dovecot-submissiond - secure POP3/IMAP server - mail submission agent Closes: 1144639 1146018 Changes: dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium . * Import upstream fixes for multiple security issues. (Closes: #1146018) - CVE-2026-27852: DoS by sending mail with bad header - CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return - CVE-2026-33605: managesieve-login: Pre-auth crash - CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service - CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT - CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c) - CVE-2026-40015: imap-hibernate can be crashed - CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c) - CVE-2026-40018: MySQL multi-byte escaping wrong - CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl restrictions - CVE-2026-42007: Sieve editheader RCE - CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command - CVE-2026-42394: sieve: symlink traversal flaw could result in arbitrary file disclosure - CVE-2026-52681: Sieve resource usage tracking lost when active script changes - CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage - CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks - CVE-2026-33606: dsync: Mail content can cause dsync protocol injection - CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text - CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy - CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages - CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons - CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes - CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path - CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim * lib-mail: istream-header-filter - Fix potential assert-crash (Closes: #1144639) * CI: Disable test-build-twice job, which is known to fail on trixie Checksums-Sha1: 9bb1e081e3f6146d9b3709e6b21f4cb2b057d9a8 31984 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb c7e370dcd3218644770d74fe1c6a15c50faa84bf 21972 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_armhf.deb 5f872539d2b15b16c3426a82288a73668ba5c4f3 9820820 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 8e031591e79e74fb730cd24a24ba59a07e121de8 2437676 dovecot-core_2.4.1+dfsg1-6+deb13u7_armhf.deb 0b3b67866a692d4c86d2f6a2be0a7eb5020f31e1 434148 dovecot-dev_2.4.1+dfsg1-6+deb13u7_armhf.deb 94b1c4f3ac549f8759b081a386b431556e3bd572 185640 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 462a2c17bc49f6d1879c103a90b45ac65456e55c 40068 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_armhf.deb 2497d7806ac9a2bef587dfc7a5d957886f93f785 21384 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb d3cef5004f3bcc49f16600f316a906478c2061ac 18932 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_armhf.deb d8c6656eeea27c6c47fdd5f742f0c8c9e0850cf7 734068 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 2394e00dc9082d2b5444e35c3dcdfe5963dc6b8f 177276 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_armhf.deb 93e08da4895d688d2d9562cdda71a04dbf881f48 164604 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb ad3785c9d4075e8c306a1a31d26b68e1036d51fa 50340 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_armhf.deb c7dea64b46a0b4129aa765b853a07cb0b0090436 100028 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb b93d11b4a095e5082ec471e32268b80581df82ac 35832 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_armhf.deb 3e3857aa6b14d853511cae19e6be1cf91cbdf490 116572 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 8e6e66ccd1f813dc9a7df2ebc86ea5d29e77028a 46284 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_armhf.deb 94172de91432d3d9c00501d2092fe320f02ec4c0 35764 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 5afacac8012876b1d66d94d9220051d97173473d 20844 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_armhf.deb 854239e0bfc7d40bd87c44b64fd26be6b9b4ed72 39108 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb ec56bb8de46d5806cd4065d84865b82487199534 24952 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_armhf.deb 17028cb2c9de4ecf78ff2f964a51de809138fe1b 102624 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb ff1c3d5b4aa6aea9692c8bbe97f9535094dd9546 43132 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_armhf.deb 5b239fd962198482dc137448922b2fddc3f4e24a 1670396 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 6c93fdb0a900368ea64f0803e6d3ff04b7a76189 339780 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_armhf.deb f0145b87bc0de135cac107c27aba8f0c94efc8b9 73780 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb a6283cf649828c5674af5fc80cad91d2aa8d5c8c 37572 dovecot-solr_2.4.1+dfsg1-6+deb13u7_armhf.deb 2960f9a9fe1bb7a720bea8350a7a2900d20655de 24900 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 38b3bae9b3e33f0444114481e2c48efb95b9e88c 20200 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_armhf.deb 412a1090607eba7320f63ce3490707016c9ec43c 206312 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 4d731ccdcdf13c01fd08ea10cd7132e0b4855f21 57544 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_armhf.deb abb51c242dc2f860cf14b5871701c6c8b952b172 18125 dovecot_2.4.1+dfsg1-6+deb13u7_armhf-buildd.buildinfo Checksums-Sha256: 01e7cae3b95a5dbf1e09056e69ee49978ef7c52f74ea7e9d7cc803eba44845cf 31984 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 9ee137aeca33419c3918194bdc94434dce5b5a0d8a731a93d6bd28766a571b0a 21972 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_armhf.deb 3ed78614a56daaa7a1f18d8e07c7ffc4859b202adda3b7276237ae713e6b80ee 9820820 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb e23c13aa3a396b41a43a7072d9a79b135c13435e6498248c7c051af7f87a3b23 2437676 dovecot-core_2.4.1+dfsg1-6+deb13u7_armhf.deb c62c97a1a3963826997c4691d970ec113487dc1bde4b649c94f45ca560e6e80e 434148 dovecot-dev_2.4.1+dfsg1-6+deb13u7_armhf.deb 340d8551ff5354b2cb8db262d8590de334b52efd23d9e5842519b501144391c2 185640 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 45e77931416be8f990a38b283aa1446cde76c62a2bebda670fb10830b219925a 40068 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_armhf.deb 55c6a1b016ecb1d2bdcbe7b83a54fcaf755545da3c8900574dd70aae2967c793 21384 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb aee34876bfbaaf5b782198a920a5972fb8d77d3b5756d7c7e1e4a624f47d389c 18932 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_armhf.deb 7bae884f2e70ef5a05cfd3a3cea81cef8a0bc00b13b9c0a5a4a4050a5cf9422b 734068 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 593a5b04ecc8ae28b62e00846d9682813786712a4096a8d6ed3c423b78ab0732 177276 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_armhf.deb 2ff24ff11f049328ca2d81ef7304d663a7d5def0df5c09efc6e4b5216cab74c1 164604 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 51d74fea2a1fde637e0bcb717747be3403031b5edb46e895e24899c0cd87f43a 50340 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_armhf.deb ce5cbc7fbaa3262aa5b7c4197d8dc2c837fbe4d72514c6657a5bbcd23291835a 100028 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 2e6d194d3659057625e826ac661bffb9fb02075ac00b1ed30a78773e88bc220e 35832 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_armhf.deb 47533272caf7f6bd7d6fee8c31ac306f93a19a35ccd960247390ad2a0e43eca5 116572 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 2bfd336ee92126dc594440210f10ce00bcf83a941efabaf7aed33c1642f9b2d9 46284 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_armhf.deb 15dcb8e967f38c669441d4c17c9dd175328830d82c62c289a432ad70361ed5ae 35764 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 538a01fa30ba2f8e7d19f9ec8af08caf6ee4b77bb428e05973146dbdca488186 20844 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_armhf.deb 288f30744e4d7be8932adda6a2cefe87b4f7f822a8e5908ab55d19751376873a 39108 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 32718f7bc1a3bd9803fe9c03753c15c978aac2c0e58353fd3e6ec805ed70ed13 24952 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_armhf.deb 6c3938ad744b6a5c412ea7c7930d7b084796cec5f70e2e2106982d0e0df78d49 102624 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 3b2b91a1bbd417719f9ceb339172b61d31690f050ca8be2e1c7d79039612831d 43132 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_armhf.deb 4d3735a30f9d5e6ce4daf91194f75a00964839f890d4772b5ff4dcd344e66082 1670396 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 1371e0c7ef57a3d8164f819f906181a0e0a05a38c1665dbe826e143979703748 339780 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_armhf.deb e35f1aa481d88186678001758c104e0e6783e866b9c8ed10409ab7c9eb38c0be 73780 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 27c4751d61c60e310e5e7f7242727409dba44ae13dccbad3177c78f90766bade 37572 dovecot-solr_2.4.1+dfsg1-6+deb13u7_armhf.deb f601ff4dd9971baecd42dfaa516b8d224c1b323d9ad85e92fd4c6851a6dd44a9 24900 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb d7b33679e1ec2eb6f8002e7bd562cb5eb88aa25e0da3a86a05fff4e1c677a93d 20200 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_armhf.deb 3460bf95baae7fe5e96f866979824795d31e409c23ccb450002be8f2526a558a 206312 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 58a10b1ea4deb25779db9304b2acbde37a7338e40fe377157b12090d8cdc3bec 57544 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_armhf.deb 1673bbbed1123bef8e296d43fcbf61eb9f7c8b9b555cdede5f21209f1e52fe75 18125 dovecot_2.4.1+dfsg1-6+deb13u7_armhf-buildd.buildinfo Files: fac5607fbdafd8df9824b6d9f5a4ae9c 31984 debug optional dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 1cc655485d0e65659ac4c3d95d92c265 21972 mail optional dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_armhf.deb da582cc79ec1ae6fc078570cc85b9f79 9820820 debug optional dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb d7fc0edf82d2a6c3b2fc6d027625677f 2437676 mail optional dovecot-core_2.4.1+dfsg1-6+deb13u7_armhf.deb 5bd5d1122bac9acebea15ea04f9959c0 434148 mail optional dovecot-dev_2.4.1+dfsg1-6+deb13u7_armhf.deb 51f9ba0e852eaac37d89f6e39f79d7e5 185640 debug optional dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 5327350a57173036b11983bd801b9791 40068 mail optional dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_armhf.deb 34c8282582afc9b608e16fe3b6edf3ea 21384 debug optional dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 1c4bae03bd3dfa3b610dd682420b0999 18932 mail optional dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_armhf.deb 3bfb87ad69b2e27c6ab42c43d473e0b4 734068 debug optional dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 3a5d4fd55e19937ae1f8cf5ee7f46fec 177276 mail optional dovecot-imapd_2.4.1+dfsg1-6+deb13u7_armhf.deb dd4e82574cb7cd644b3a2a06ba54d663 164604 debug optional dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 85928faa27de168490ed66bd496180ba 50340 mail optional dovecot-ldap_2.4.1+dfsg1-6+deb13u7_armhf.deb f257e17ab892622ac79319992661aaf8 100028 debug optional dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 1110bc17926e5573317ad44935f3009f 35832 mail optional dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_armhf.deb 4ebc107f4a1bca09d5a832799b23bcf3 116572 debug optional dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 92e892804dd7794d422734d9c4ae1009 46284 mail optional dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_armhf.deb c3ec61d6333ace80480a3c9bbc8c65aa 35764 debug optional dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb b3e4be9156c4d064a554f1add8cf6612 20844 mail optional dovecot-mysql_2.4.1+dfsg1-6+deb13u7_armhf.deb c83aba8df433f791fadece79f1f0fa01 39108 debug optional dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb eb5e050b72e10069327c15ccd35fc92f 24952 mail optional dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_armhf.deb c9a0303e19de7b8bc92b0558eab28980 102624 debug optional dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb bcecfb7af20b83714a834eabd4e9e916 43132 mail optional dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_armhf.deb 0dce51a930505993c80038c33f5ecf22 1670396 debug optional dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 35744ba5d660149531ef9d0f0a2a689c 339780 mail optional dovecot-sieve_2.4.1+dfsg1-6+deb13u7_armhf.deb 36075d9454de75eb7549bd8cde1e5a9a 73780 debug optional dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb a16578fda8c8471354b0f894d46b6be4 37572 mail optional dovecot-solr_2.4.1+dfsg1-6+deb13u7_armhf.deb 493dd2915019f3746bb998d0f68558ae 24900 debug optional dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 95d66761d5dd46aec3dd83a27cc09397 20200 mail optional dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_armhf.deb c46d80002cfe786344ab8a543ba4a50a 206312 debug optional dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_armhf.deb 8b56c33332f51fbb951457b70232042d 57544 mail optional dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_armhf.deb 390627336e6047754e61407f1abc25ee 18125 mail optional dovecot_2.4.1+dfsg1-6+deb13u7_armhf-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7rv+l3KtZdQea77lnwznazfjXToFAmq5IqUACgkQnwznazfj XTof2BAAuk0PU6M6FHpJOGpTll/NB6zjBbGooO55RGFuhXMKFfsLHmSGqxsnf7CT n+/P4X9I6vS3r4WVWbRPT03dKOJtoUkstJeGHM3vdlt+3IflR++YHDa1EX1m2W6D +RT3qdjmL966lLzMixc1ZJPgWlbs5jux268/zUQZT/3sFGUc1UuXlPtkBnOpmyLF DHpGvSF9k188lRigMUCmCB0250Wowfc11n5LkOc7LyIxImI8X8BfgPXnZfqiE8T/ gNOIj5L+0CuWFxGaahHOWYEDK3ddDCCQQ7xEEfYsSWYJXFUP3+cojXlJWlN+EprF B4ZDWnXEOgjyM2JOLmzybmo3INpLiZM4BThsMJ2tOEjVgZrMWl7XzlC7nozLJBh+ HGDMYwkSKv0PJlz7WV1x3ySXQmS9LH7hycRCvsBDqVN/NgHRqwSG0JUwIgqRCRCY /4FmNvNZiI9lFY2aELhHR28QMm4yesYDObcBnnZB+9BAp5bveIKkCm8O/LwxWlZ/ M79gHKS9LzsEOUDX1ALTy6jwG0C0zmxp7i8FcIZFMMhv+cU9p7UgHway27PRJBmT FH2NOV95J2vQCkB248u5M0xmz/5cWeWwycj3OpoJDr1QrvBsdgjRJY46djHdKDtA BQo7bCFoKZ+dI6bTp1GfS2zqQ05qVuOMbVA2OzW9DBpZ6UFGSVQ= =vuxE -----END PGP SIGNATURE-----