ELSA-2026-76763

ELSA-2026-76763 - dovecot security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-06

Description

[1:2.3.16-15]
- fix CVE-2026-33605: ManageSieve login deadlock caused by lone CR
protocol violation (RHEL-251995)

[1:2.3.16-14]
- fix CVE-2026-42007: heap use-after-free in pigeonhole edit_mail_snapshot
after deleteheader operation (RHEL-251946)

[1:2.3.16-13]
- fix CVE-2026-40018: incorrect escaping of multi-byte strings in SQL commands (RHEL-252064)

[1:2.3.16-13]
- fix CVE-2026-42391: pre-auth CPU/memory amplification via
excessive ID command key/value pairs (RHEL-252056)

[1:2.3.16-12]
- fix CVE-2026-73208: OAuth2 scope check requires all configured scopes, add oauth2_audience setting (RHEL-251905)

[1:2.3.16-11]
- fix CVE-2026-27852: denial of service via memory exhaustion from
crafted message headers (RHEL-251573)

[1:2.3.16-10]
- fix CVE-2026-33263: submission-login panic at
mail_max_userip_connections limit (RHEL-251922)

[1:2.3.16-9]
- fix mailbox leak causing assert crash (RHEL-176273)

Related CVEs

CVE-2026-27852

CVE-2026-33263

CVE-2026-33605

CVE-2026-40018

CVE-2026-40019

CVE-2026-42007

CVE-2026-42391

CVE-2026-73208

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	dovecot-2.3.16-16.el8_10.src.rpm	473cefd9a994ff82b3ccbb33aade1daf72251df8a93354fc34c2963f56208719	-	ol8_aarch64_appstream
	dovecot-2.3.16-16.el8_10.src.rpm	473cefd9a994ff82b3ccbb33aade1daf72251df8a93354fc34c2963f56208719	-	ol8_aarch64_codeready_builder
	dovecot-2.3.16-16.el8_10.aarch64.rpm	05019aebdfd2bae7e794f6ac26cac03716799c79e40bfdbf2f4fcbbe8c8625ee	-	ol8_aarch64_appstream
	dovecot-devel-2.3.16-16.el8_10.aarch64.rpm	c41354c2aeeab2160c78fd24ed6947e4d360c27a74ad1f9f641421a1e1ef7b8c	-	ol8_aarch64_codeready_builder
	dovecot-mysql-2.3.16-16.el8_10.aarch64.rpm	660ec2f5d2b5a7fb40a760a3e3b704ccffe9edee701ddd10801e995e8c42f981	-	ol8_aarch64_appstream
	dovecot-pgsql-2.3.16-16.el8_10.aarch64.rpm	ebb7d0851a03a5ad3ae979ebbadd02bebbd9231216a8a3dfae79825cb5b93eb0	-	ol8_aarch64_appstream
	dovecot-pigeonhole-2.3.16-16.el8_10.aarch64.rpm	21538aacebd309ac4a7b0f8cbb3a61212ad6ecb0192ddd0cee3a0591874b1774	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	dovecot-2.3.16-16.el8_10.src.rpm	473cefd9a994ff82b3ccbb33aade1daf72251df8a93354fc34c2963f56208719	-	ol8_x86_64_appstream
	dovecot-2.3.16-16.el8_10.src.rpm	473cefd9a994ff82b3ccbb33aade1daf72251df8a93354fc34c2963f56208719	-	ol8_x86_64_codeready_builder
	dovecot-2.3.16-16.el8_10.i686.rpm	3817bfa535dcb77e0ceb93d1efc86740473523fd7283eb703114ba41a5c2efa8	-	ol8_x86_64_codeready_builder
	dovecot-2.3.16-16.el8_10.x86_64.rpm	6d4aac40a045abc57f7f3d2db32b52295e64e3945ff9758c9a5b2603f450f927	-	ol8_x86_64_appstream
	dovecot-devel-2.3.16-16.el8_10.i686.rpm	7ac010a76a7e07dabcb4ce27043647956855f74133245da6b19ec14797f80290	-	ol8_x86_64_codeready_builder
	dovecot-devel-2.3.16-16.el8_10.x86_64.rpm	b797794183bfded9ed5fa715a2880626db903788c9da41cfded40bb0ecbffd15	-	ol8_x86_64_codeready_builder
	dovecot-mysql-2.3.16-16.el8_10.x86_64.rpm	d9ea6780124186d543ae2b13e14eee929a369fca9f96cfd0e8fa32cf8efeb54c	-	ol8_x86_64_appstream
	dovecot-pgsql-2.3.16-16.el8_10.x86_64.rpm	09dcf74d05b4b72eb569093520cf290b3425c7a7d32717c6c5a98fbcfa399615	-	ol8_x86_64_appstream
	dovecot-pigeonhole-2.3.16-16.el8_10.x86_64.rpm	9d3a1fe1fdf86ee5fcf64f10beccdc425e852f224b120592b6b0d44ac66af228	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team