Описание
ELSA-2026-80825: dovecot security update (IMPORTANT)
[1:2.3.16-18.8]
- fix CVE-2026-33605: ManageSieve protocol denial of service via lone CR character (RHEL-251989)
[1:2.3.16-18.7]
- fix CVE-2026-42007: use-after-free in pigeonhole editheader (RHEL-251952)
[1:2.3.16-18.6]
- fix CVE-2026-40018: incorrect escaping of multi-byte strings in SQL commands (RHEL-252068)
[1:2.3.16-18.5]
- fix CVE-2026-42391: excessive memory growth with pre-login IMAP ID command (RHEL-251936)
[1:2.3.16-18.4]
- fix CVE-2026-73208: OAuth2 scope check requires all configured scopes, add oauth2_audience setting (RHEL-251911)
[1:2.3.16-18.3]
- fix CVE-2026-27852: limit parsed message data to prevent memory exhaustion (RHEL-251575)
[1:2.3.16-18.2]
- fix CVE-2026-33263: epoll_ctl panic at mail_max_userip_connections limit (RHEL-251929)
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
dovecot
2.3.16-18.el9_8.8
dovecot-devel
2.3.16-18.el9_8.8
dovecot-mysql
2.3.16-18.el9_8.8
dovecot-pgsql
2.3.16-18.el9_8.8
dovecot-pigeonhole
2.3.16-18.el9_8.8
Oracle Linux x86_64
dovecot
2.3.16-18.el9_8.8
dovecot-devel
2.3.16-18.el9_8.8
dovecot-mysql
2.3.16-18.el9_8.8
dovecot-pgsql
2.3.16-18.el9_8.8
dovecot-pigeonhole
2.3.16-18.el9_8.8
