Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Dovecot mail server can run out of memory on IMAP login
published 5 months ago
Summary
The Dovecot packages for CentOS (including the main server and its MySQL, PostgreSQL, and Pigeonhole extensions) had a coding error that could let a specially crafted login request consume all of the server’s memory, potentially crashing the service. This could be used to disrupt email availability. Updating Dovecot to the latest version provided by CentOS resolves the issue.
What to do
- Update centos dovecot to version 1:2.0.9-23.el6.tuxcare.els5.
- Update centos dovecot-devel to version 1:2.0.9-23.el6.tuxcare.els5.
- Update centos dovecot-mysql to version 1:2.0.9-23.el6.tuxcare.els5.
- Update centos dovecot-pgsql to version 1:2.0.9-23.el6.tuxcare.els5.
- Update centos dovecot-pigeonhole to version 1:2.0.9-23.el6.tuxcare.els5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:6 | centos | dovecot |
< 1:2.0.9-23.el6.tuxcare.els5 Fix: upgrade to 1:2.0.9-23.el6.tuxcare.els5
|
| TuxCare:CentOS:6 | centos | dovecot-devel |
< 1:2.0.9-23.el6.tuxcare.els5 Fix: upgrade to 1:2.0.9-23.el6.tuxcare.els5
|
| TuxCare:CentOS:6 | centos | dovecot-mysql |
< 1:2.0.9-23.el6.tuxcare.els5 Fix: upgrade to 1:2.0.9-23.el6.tuxcare.els5
|
| TuxCare:CentOS:6 | centos | dovecot-pgsql |
< 1:2.0.9-23.el6.tuxcare.els5 Fix: upgrade to 1:2.0.9-23.el6.tuxcare.els5
|
| TuxCare:CentOS:6 | centos | dovecot-pigeonhole |
< 1:2.0.9-23.el6.tuxcare.els5 Fix: upgrade to 1:2.0.9-23.el6.tuxcare.els5
|
Original advisory text
dovecot: Fix of 2 CVEs
- CVE-2026-42006: lib-imap: fix list_count_limit to actually count open '(' instead of close ')', preventing an imap-login memory-exhaustion DoS that bypassed the CVE-2026-27857 fix
References
Timeline
Published21 May 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1779371000 · OSV
Track software like this
Free during beta