
CVE catalog
CVE-2026-27860
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure.
- Severity
- Low · CVSS 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.30% · Oct 25, 2026
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | dovecot | sid | 1:2.4.5+dfsg1-4 | fixed |
| Debian | dovecot | forky | 1:2.4.5+dfsg1-4 | fixed |
| Debian | dovecot | trixie | 1:2.4.1+dfsg1-6+deb13u6 | fixed |
| Debian | dovecot | trixie-security | 1:2.4.1+dfsg1-6+deb13u7 | fixed |
| Debian | dovecot | bookworm | 1:2.3.19.1+dfsg1-2.1+deb12u6 | not affected |
| Debian | dovecot | bookworm-security | 1:2.3.19.1+dfsg1-2.1+deb12u6 | not affected |
| Cpe | dovecot | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-auth-lua | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-core | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-dev | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-gssapi | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-imapd | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-ldap | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-lmtpd | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-managesieved | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-mysql | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-pgsql | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-pop3d | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-sieve | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-solr | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-sqlite | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot-submissiond | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | fixed |
| Cpe | dovecot | Not reported | 2.4.3 | fixed |
| Cpe | dovecot | Not reported | 3.1.4 | fixed |
| Cpe | dovecot | Not reported | Not reported | not affected |
| Alpine | dovecot | 3.23 | 2.4.3-r0 | fixed |
| Alpine | dovecot | 3.24 | 2.4.3-r0 | fixed |
| Ubuntu | dovecot | 25.10 | 1:2.3.21.1+dfsg1-1ubuntu2 | vulnerable |
| Ubuntu | dovecot | 25.10 | 1:2.4.1+dfsg1-5ubuntu1 | vulnerable |
| Ubuntu | dovecot | 25.10 | 1:2.4.1+dfsg1-5ubuntu3 | vulnerable |
| Ubuntu | dovecot | 25.10 | 1:2.4.1+dfsg1-5ubuntu4 | vulnerable |
| Ubuntu | dovecot | 25.10 | 1:2.4.1+dfsg1-5ubuntu4.1 | fixed |
| Cpe | dovecot | Not reported | 3.1.4 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | dovecot | source | sid | 1:2.4.3+dfsg1-1 | not yet assigned | Not reported | Not reported |
| Debian | dovecot | source | forky | 1:2.4.3+dfsg1-1 | not yet assigned | Not reported | Not reported |
| Debian | dovecot | source | trixie | 1:2.4.1+dfsg1-6+deb13u4 | not yet assigned | Not reported | Not reported |
| Debian | dovecot | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | dovecot | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-auth-lua | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-core | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-dev | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-gssapi | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-imapd | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-ldap | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-lmtpd | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-managesieved | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-mysql | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-pgsql | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-pop3d | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-sieve | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-solr | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-sqlite | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot-submissiond | cpe | Not reported | 1:2.3.21+dfsg1-2ubuntu6.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot | cpe | Not reported | 2.4.3 | Not reported | Not reported | Not reported |
| Cpe | dovecot | cpe | Not reported | 3.1.4 | Not reported | Not reported | Not reported |
| Alpine | dovecot | apk | 3.23 | 2.4.3-r0 | Not reported | ALPINE-CVE-2026-27860 | Not reported |
| Alpine | dovecot | apk | 3.24 | 2.4.3-r0 | Not reported | ALPINE-CVE-2026-27860 | Not reported |
| Ubuntu | dovecot | deb | 25.10 | 1:2.4.1+dfsg1-5ubuntu4.1 | Not reported | UBUNTU-CVE-2026-27860 | Not reported |
| Cpe | dovecot | cpe | Not reported | 3.1.4 | Not reported | NVD-CVE-2026-27860 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [dovecot-auth-lua]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-core]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-dev]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-gssapi]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-imapd]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-ldap]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-lmtpd]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-lucene]Not affected
Source package: [dovecot]
Details (4)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-managesieved]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-mysql]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-pgsql]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-pop3d]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-sieve]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-solr]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-sqlite]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
- [dovecot-submissiond]Not affected
Source package: [dovecot]
Details (6)
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookwormNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.21.1+dfsg1-1~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· amd64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6· arm64 · bookworm-securityNot affected
nvd · dovecot · debian · bookworm
[Debian 13 (Trixie)]
- [dovecot-auth-lua]Fixed
Source package: [dovecot]
Details (5)
1:2.4.1+dfsg1-6+deb13u6· amd64 · trixieFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· arm64 · trixieFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· amd64 · trixie-security · Historical versionFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· arm64 · trixie-securityFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u7· amd64 · trixie-securityFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
- [dovecot-core]Fixed
Source package: [dovecot]
Details (5)
1:2.4.1+dfsg1-6+deb13u6· amd64 · trixieFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· arm64 · trixieFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· amd64 · trixie-security · Historical versionFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· arm64 · trixie-securityFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u7· amd64 · trixie-securityFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
- [dovecot-dev]Fixed
Source package: [dovecot]
Details (5)
1:2.4.1+dfsg1-6+deb13u6· amd64 · trixieFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· arm64 · trixieFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· amd64 · trixie-security · Historical versionFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· arm64 · trixie-securityFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u7· amd64 · trixie-securityFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
- [dovecot-flatcurve]Fixed
Source package: [dovecot]
Details (5)
1:2.4.1+dfsg1-6+deb13u6· amd64 · trixieFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· arm64 · trixieFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· amd64 · trixie-security · Historical versionFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u6· arm64 · trixie-securityFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
1:2.4.1+dfsg1-6+deb13u7· amd64 · trixie-securityFixed · Fixed:
1:2.4.1+dfsg1-6+deb13u4nvd · dovecot · debian · 13
Observed:
References
- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10442-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-27860]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-27860]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-27860]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-27860]
- [https://security-tracker.debian.org/tracker/CVE-2026-27860]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27860.json]
- [https://ubuntu.com/security/notices/USN-8136-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0891.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]