Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Dovecot: Unauthenticated Access to Mail Server
published 5 months ago
Summary
A security update is available for Dovecot, a popular mail server software. If left unpatched, an attacker could potentially access a user's email account without needing a password. To protect your mail server, update Dovecot to the latest version as soon as possible.
What to do
- Update redhat dovecot to version 1:2.3.21-19.el10_2.
- Update redhat dovecot-debuginfo to version 1:2.3.21-19.el10_2.
- Update redhat dovecot-debugsource to version 1:2.3.21-19.el10_2.
- Update redhat dovecot-devel to version 1:2.3.21-19.el10_2.
- Update redhat dovecot-mysql to version 1:2.3.21-19.el10_2.
- Update redhat dovecot-mysql-debuginfo to version 1:2.3.21-19.el10_2.
- Update redhat dovecot-pgsql to version 1:2.3.21-19.el10_2.
- Update redhat dovecot-pgsql-debuginfo to version 1:2.3.21-19.el10_2.
- Update redhat dovecot-pigeonhole to version 1:2.3.21-19.el10_2.
- Update redhat dovecot-pigeonhole-debuginfo to version 1:2.3.21-19.el10_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot-debuginfo |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot-debugsource |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot-devel |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot-mysql |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot-mysql-debuginfo |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot-pgsql |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot-pgsql-debuginfo |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot-pigeonhole |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
| Red Hat:enterprise_linux:10.2 | redhat | dovecot-pigeonhole-debuginfo |
< 1:2.3.21-19.el10_2 Fix: upgrade to 1:2.3.21-19.el10_2
|
Original advisory text
Red Hat Security Advisory: dovecot security update
References
- https://access.redhat.com/errata/RHSA-2026:19149 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452172 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452175 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452179 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19149.... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-59032 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-59032 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-59032 Vendor Advisory
- https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxd... Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-27857 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-27857 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27857 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-27858 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-27858 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27858 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published20 May 2026
Updated18 Jun 2026
First seen18 Jun 2026
Sources
RHSA-2026:19149 · OSV
Track software like this
Free during beta