{"id":"CLSA-2026-1792570553","summary":"dovecot: Fix of 7 CVEs","details":"- CVE-2026-27852: bound the transient RFC 2231 parameter list and the MIME\n  parameter budget so a single oversized Content-Type header cannot exhaust\n  imap memory\n- CVE-2026-33263: track SMTP server connection closure so submission-login\n  does not keep using a closed connection\n- CVE-2026-33605: fix ManageSieve parser handling of a single-byte quoted\n  string read in managesieve-login\n- CVE-2026-40018: connect before expanding the passdb-sql password query and\n  refuse to escape in the MySQL driver without a connection instead of\n  escaping with the default charset\n- CVE-2026-42007: fix Sieve editheader edit-mail handling of deleted and\n  NUL-containing header values\n- CVE-2026-42391: account external key/value pairs in the IMAP login ID\n  command so a client cannot send an unbounded number of them\n- CVE-2026-73208: validate the OAuth2 token audience and stop falling back to\n  the aud claim when audience is configured","modified":"2026-10-26T09:31:00.261538056Z","published":"2026-10-21T08:16:09Z","upstream":["CVE-2026-27852","CVE-2026-33263","CVE-2026-33605","CVE-2026-40018","CVE-2026-42007","CVE-2026-42391","CVE-2026-73208"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792570553.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27852"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33263"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33605"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40018"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42007"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42391"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73208"}],"affected":[{"package":{"name":"dovecot","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/dovecot?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792570553.json"}},{"package":{"name":"dovecot-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/dovecot-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792570553.json"}},{"package":{"name":"dovecot-mysql","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/dovecot-mysql?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792570553.json"}},{"package":{"name":"dovecot-pgsql","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/dovecot-pgsql?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792570553.json"}},{"package":{"name":"dovecot-pigeonhole","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/dovecot-pigeonhole?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792570553.json"}}],"schema_version":"1.9.0"}