This Red Hat security advisory addresses multiple high-severity vulnerabilities in Dovecot, including a timing oracle attack in Doveadm credential verification (CVE-2026-27856, CVSS 7.4) allowing full access, and three denial-of-service vectors via crafted SASL responses, messages, or NOOP commands (CVE-2025-59032, CVE-2026-27858, CVE-2026-27857, CVSS up to 7.5). Affected versions are Dovecot prior to 2.4.3, as well as specific ranges of the 2.3.x, 3.0.x, and 3.1.x branches. The fix requires upgrading to patched versions, specifically 2.4.3, 2.3.22.1, 3.0.5, or 3.1.4, depending on the branch in use.
Red Hat Product Errata RHSA-2026:26564 - Security Advisory Issued: 2026-06-17 Updated: 2026-06-17 RHSA-2026:26564 - Security Advisory Overview Updated Packages Synopsis Important: dovecot security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for dovecot is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): dovecot: Doveadm: Full access via timing oracle attack in credential verification (CVE-2026-27856) dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) dovecot: denial of service via crafted message before authentication (CVE-2026-27858) dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le Fixes BZ - 2452171 - CVE-2026-27856 dovecot: Doveadm: Full access via timing oracle attack in credential verification BZ - 2452172 - CVE-2025-59032 dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command BZ - 2452175 - CVE-2026-27858 dovecot: denial of service via crafted message before authentication BZ - 2452179 - CVE-2026-27857 dovecot: denial of service via specially crafted NOOP command CVEs CVE-2025-59032 CVE-2026-27856 CVE-2026-27857 CVE-2026-27858 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 SRPM dovecot-2.2.36-8.el7_9.1.src.rpm SHA-256: b931f43eb83ce1d44c6fd0a46bc7ba16aa20949a38da8ee6f5cd6a7cc09c1638 x86_64 dovecot-2.2.36-8.el7_9.1.i686.rpm SHA-256: c849345488119d45919b702e29725fba3eaf5564699dee12a5367a380120ba63 dovecot-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 707d9911a79208cfe856a60f4dc2b7e30767ae8e2662f19d02b395bb283c110d dovecot-debuginfo-2.2.36-8.el7_9.1.i686.rpm SHA-256: 2f5237eece4cb6dd492bcf72842e129eb2af09a01da77fdc196bad6138e8f95d dovecot-debuginfo-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 44ae7a097930d768130ef6b3df67e5d6ca01e396de7d7dfeea1d72dbf226bb9b dovecot-debuginfo-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 44ae7a097930d768130ef6b3df67e5d6ca01e396de7d7dfeea1d72dbf226bb9b dovecot-devel-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 3ea09d763e61dcdb5ffb04e23c4143c4f0088a0e61ca0149c9d5eccc83379c54 dovecot-mysql-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 54677ca1b7f5f5353ee567bc70f92cfbf3181aef8a1a56b20569313088c96580 dovecot-pgsql-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 9c01a5430546570eda1bf3f711ad47ad710271122f044ee4e1a47d7aecd5e4a6 dovecot-pigeonhole-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 41197bf5a1a8b4a1dc0142c378e871049c96db02a80e48ae13872055e6e4e82d Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 SRPM dovecot-2.2.36-8.el7_9.1.src.rpm SHA-256: b931f43eb83ce1d44c6fd0a46bc7ba16aa20949a38da8ee6f5cd6a7cc09c1638 s390x dovecot-2.2.36-8.el7_9.1.s390.rpm SHA-256: a70d623d8896927896941a8254e0ecf372935fc5505bf92acdf4d571ce413303 dovecot-2.2.36-8.el7_9.1.s390x.rpm SHA-256: a27c00f5cf3650c5a3a8bec2ac8dfad0a39c5d494279a319bb41d1bad30b6486 dovecot-debuginfo-2.2.36-8.el7_9.1.s390.rpm SHA-256: 76b05de91ee77e70c0129c549364fdb38f39a2976b5b71291813d7850c57a8fc dovecot-debuginfo-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 77dc263d048888724d74f183257b44615b73f72a4764573e5c60e261a2a5333f dovecot-debuginfo-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 77dc263d048888724d74f183257b44615b73f72a4764573e5c60e261a2a5333f dovecot-devel-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 5d3734d795cb23e8c0f42b8809a019511c7555180354748a3e141b7d683ecb05 dovecot-mysql-2.2.36-8.el7_9.1.s390x.rpm SHA-256: d70c69e9f0df59a070df1070f6a709f5e244b03286107fca8130881cb1368d2c dovecot-pgsql-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 18297f82572106133b71337de95b714c31cee77b9fe22d945ce32012cbc66dcd dovecot-pigeonhole-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 7469acafa6d5a6b1055a627b7b00e4a3b407e42669031654422febe147a58c9f Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 SRPM dovecot-2.2.36-8.el7_9.1.src.rpm SHA-256: b931f43eb83ce1d44c6fd0a46bc7ba16aa20949a38da8ee6f5cd6a7cc09c1638 ppc64 dovecot-2.2.36-8.el7_9.1.ppc.rpm SHA-256: 55f82615d67850540de9d03c8e9167f6b20f1b5ce625be231cce5ac2116f175c dovecot-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 9ec204c686d64f266c5b971ae573815410d0b8347ab9b466dcdfe5f3d233a6b7 dovecot-debuginfo-2.2.36-8.el7_9.1.ppc.rpm SHA-256: bcd9d4cfa2501c62864e207c5cf1189415dbe6ff9257ac23a2619665d8e6b243 dovecot-debuginfo-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 9926f686450633b220a543f3fe5edd547eb939cee467d309d2aee9cc3f190a0c dovecot-debuginfo-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 9926f686450633b220a543f3fe5edd547eb939cee467d309d2aee9cc3f190a0c dovecot-devel-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: d2835e5730afd0f8d0545bee4551f3bedcd7c68e6eccbf39e5d5736d822fceac dovecot-mysql-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 53dab5501bf6e39f7cd18df4e7c01d90641c2706d15d1b7b39c8dd256ef64637 dovecot-pgsql-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 9a118e4fb6d0b6aa0959e579994d7d03e6a1649a67f33f77335493451a67ef2f dovecot-pigeonhole-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 2231f0631cfae85cd4406228187bf85ffa79cce2606cbf2957c799d24f4b4d2b Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 SRPM dovecot-2.2.36-8.el7_9.1.src.rpm SHA-256: b931f43eb83ce1d44c6fd0a46bc7ba16aa20949a38da8ee6f5cd6a7cc09c1638 ppc64le dovecot-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 02266ebd7b56e08a05aac3a984e450502636e671de3ce482e41d78d590898f36 dovecot-debuginfo-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 90d3b6d5bc1ebc47c2d846422574d05c38fa9ac4b27693186d7ff76d99a52999 dovecot-debuginfo-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 90d3b6d5bc1ebc47c2d846422574d05c38fa9ac4b27693186d7ff76d99a52999 dovecot-devel-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 078a5104a25fdb4be4e797c7e323e0edc9737d2fb93dd39aab189410d79a4320 dovecot-mysql-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 498242138daddaa4bb6225862db573f5992c30abcd88a5c25815ba74d65e87b2 dovecot-pgsql-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: a193389cc4103af40ef88f775678d86de5f64dfb283fea94c1963a1890bde8c3 dovecot-pigeonhole-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 8df9dd7a79c8c17f24b95850c5c1b208c4c44250531e1d3ba6977a17311bc36e The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .