Packages
- dovecot - IMAP and POP3 email server
Details
It was discovered that Dovecot incorrectly handled invalid base64 SASL data.
An attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 25.10. (CVE-2025-59028)
It was discovered that Dovecot script decode2text.sh incorrectly handled zip
files. An attacker could possibly use this issue to obtain sensitive
information. (CVE-2025-59031)
It was discovered that Dovecot incorrectly handled certain AUTHENTICATE
requests. An attacker could possibly use this issue to cause a denial of
service. (CVE-2025-59032)
It was discovered that Dovecot incorrectly handled certain SQL based
authentication. An attacker could possibly use this issue to bypass
authentication. This issue only affected Ubuntu 25.10. (CVE-2026-24031)
It was...
It was discovered that Dovecot incorrectly handled invalid base64 SASL data.
An attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 25.10. (CVE-2025-59028)
It was discovered that Dovecot script decode2text.sh incorrectly handled zip
files. An attacker could possibly use this issue to obtain sensitive
information. (CVE-2025-59031)
It was discovered that Dovecot incorrectly handled certain AUTHENTICATE
requests. An attacker could possibly use this issue to cause a denial of
service. (CVE-2025-59032)
It was discovered that Dovecot incorrectly handled certain SQL based
authentication. An attacker could possibly use this issue to bypass
authentication. This issue only affected Ubuntu 25.10. (CVE-2026-24031)
It was discovered that Dovecot incorrectly handled certain LDAP based
authentication. An attacker could possibly use this issue to bypass
restrictions and allow probing of LDAP structure. This issue only affected
Ubuntu 25.10. (CVE-2026-27860)
It was discovered that Dovecot is vulnerable to replay attack under
certain conditions. An attacker could possibly use this issue to bypass
authentication. (CVE-2026-27855)
It was discovered that Dovecot is vulnerable to a timing attack under
certain conditions. An attacker could possibly use this issue to bypass
authentication. (CVE-2026-27856)
It was discovered that Dovecot incorrectly handled certain IMAP login
requests. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-27857)
It was discovered that Dovecot incorrectly handled certain specially
crafted messages. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-27858)
It was discovered that Dovecot incorrectly handled certain specially
crafted mail messages. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-27859)
It was discovered that Dovecot incorrectly handles file paths. A attacker
could possibly use this issue to perform a path traversal and obtain or
modify arbitrary files. This issue only affected Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2026-0394)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 25.10 questing | dovecot-core – 1:2.4.1+dfsg1-5ubuntu4.1 | ||
| 24.04 LTS noble | dovecot-core – 1:2.3.21+dfsg1-2ubuntu6.3 | ||
| 22.04 LTS jammy | dovecot-core – 1:2.3.16+dfsg1-3ubuntu2.7 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
References
- CVE-2026-27860
- CVE-2026-27859
- CVE-2026-27858
- CVE-2026-27857
- CVE-2026-27856
- CVE-2026-27855
- CVE-2026-24031
- CVE-2026-0394
- CVE-2025-59032
- CVE-2025-59031
- CVE-2026-27860
- CVE-2026-27859
- CVE-2026-27858
- CVE-2026-27857
- CVE-2026-27856
- CVE-2026-27855
- CVE-2026-24031
- CVE-2026-0394
- CVE-2025-59032
- CVE-2025-59031
- CVE-2025-59028