ELSA-2026-76763

Описание

[1:2.3.16-15]

• fix CVE-2026-33605: ManageSieve login deadlock caused by lone CR protocol violation (RHEL-251995)

[1:2.3.16-14]

• fix CVE-2026-42007: heap use-after-free in pigeonhole edit_mail_snapshot after deleteheader operation (RHEL-251946)

[1:2.3.16-13]

• fix CVE-2026-40018: incorrect escaping of multi-byte strings in SQL commands (RHEL-252064)

[1:2.3.16-13]

• fix CVE-2026-42391: pre-auth CPU/memory amplification via excessive ID command key/value pairs (RHEL-252056)

[1:2.3.16-12]

• fix CVE-2026-73208: OAuth2 scope check requires all configured scopes, add oauth2_audience setting (RHEL-251905)

[1:2.3.16-11]

• fix CVE-2026-27852: denial of service via memory exhaustion from crafted message headers (RHEL-251573)

[1:2.3.16-10]

• fix CVE-2026-33263: submission-login panic at mail_max_userip_connections limit (RHEL-251922)

[1:2.3.16-9]

• fix mailbox leak causing assert crash (RHEL-176273)