ELSA-2026-80825

ELSA-2026-80825 - dovecot security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-12

Description

[1:2.3.16-18.8]
- fix CVE-2026-33605: ManageSieve protocol denial of service via
lone CR character (RHEL-251989)

[1:2.3.16-18.7]
- fix CVE-2026-42007: use-after-free in pigeonhole editheader
(RHEL-251952)

[1:2.3.16-18.6]
- fix CVE-2026-40018: incorrect escaping of multi-byte strings in SQL commands (RHEL-252068)

[1:2.3.16-18.5]
- fix CVE-2026-42391: excessive memory growth with pre-login IMAP ID
command (RHEL-251936)

[1:2.3.16-18.4]
- fix CVE-2026-73208: OAuth2 scope check requires all configured scopes, add oauth2_audience setting (RHEL-251911)

[1:2.3.16-18.3]
- fix CVE-2026-27852: limit parsed message data to prevent memory
exhaustion (RHEL-251575)

[1:2.3.16-18.2]
- fix CVE-2026-33263: epoll_ctl panic at
mail_max_userip_connections limit (RHEL-251929)

Related CVEs

CVE-2026-27852

CVE-2026-33263

CVE-2026-33605

CVE-2026-40018

CVE-2026-40019

CVE-2026-42007

CVE-2026-42391

CVE-2026-73208

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	dovecot-2.3.16-18.el9_8.8.src.rpm	3c06b008127c7e099430e07c8e766e31fd12acbfa0b6f8dcb2bbeab2fbc697b9	-	ol9_aarch64_appstream
	dovecot-2.3.16-18.el9_8.8.src.rpm	3c06b008127c7e099430e07c8e766e31fd12acbfa0b6f8dcb2bbeab2fbc697b9	-	ol9_aarch64_codeready_builder
	dovecot-2.3.16-18.el9_8.8.aarch64.rpm	9b26933afab9694a4776abc308bc2a3ffa1fb36a51bff50a8b1493b57610890a	-	ol9_aarch64_appstream
	dovecot-devel-2.3.16-18.el9_8.8.aarch64.rpm	2e7d7b47b17470168a23edf996f68335b0e6457f8e16068b4d350eba4ae033a4	-	ol9_aarch64_codeready_builder
	dovecot-mysql-2.3.16-18.el9_8.8.aarch64.rpm	c4c1834c7901a8d1ba46c912fcf0d5d63a481d0547065e69e84e23d1a9407328	-	ol9_aarch64_appstream
	dovecot-pgsql-2.3.16-18.el9_8.8.aarch64.rpm	980af8d379648d85e0580052cb3d11cd89cd0a0f7b6ad51fe1b580ac8c930039	-	ol9_aarch64_appstream
	dovecot-pigeonhole-2.3.16-18.el9_8.8.aarch64.rpm	96b3d5998be1bac9774c73149460da50ce6469a8907b675ebf99abda95b1fce4	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	dovecot-2.3.16-18.el9_8.8.src.rpm	3c06b008127c7e099430e07c8e766e31fd12acbfa0b6f8dcb2bbeab2fbc697b9	-	ol9_x86_64_appstream
	dovecot-2.3.16-18.el9_8.8.src.rpm	3c06b008127c7e099430e07c8e766e31fd12acbfa0b6f8dcb2bbeab2fbc697b9	-	ol9_x86_64_codeready_builder
	dovecot-2.3.16-18.el9_8.8.i686.rpm	309eb236afb4cc31f46eb59202e735d2a0c9be8c9f8964ea137231ab29c201a6	-	ol9_x86_64_codeready_builder
	dovecot-2.3.16-18.el9_8.8.x86_64.rpm	aba5006ca3dd9c199256e803e367e6f933b5c8a9e4d2296f0f17e9d9786600ba	-	ol9_x86_64_appstream
	dovecot-devel-2.3.16-18.el9_8.8.i686.rpm	2696208268cdfd31ef919eebd5c94a8a6fd7e3dc5ae28154b03f4634d0ca835d	-	ol9_x86_64_codeready_builder
	dovecot-devel-2.3.16-18.el9_8.8.x86_64.rpm	2c907ce1fef9ec92edbf0b013d297e7e00be871626f8733295d6bf996abd7282	-	ol9_x86_64_codeready_builder
	dovecot-mysql-2.3.16-18.el9_8.8.x86_64.rpm	19c682266aa9565e3a4b6ce1f6730211f1c7afc28dc45c96ea661c95c99649dc	-	ol9_x86_64_appstream
	dovecot-pgsql-2.3.16-18.el9_8.8.x86_64.rpm	8ef8927d34000563f1b3f56fff4ca8fdd67e5401e7815c9cd74f7b012a46abca	-	ol9_x86_64_appstream
	dovecot-pigeonhole-2.3.16-18.el9_8.8.x86_64.rpm	851669b0a5571c9b1eeb74fba8ea4387915571800d2e4bfcdf6804713f184ff7	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team