-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 16 Sep 2026 15:06:35 -0400 Source: dovecot Binary: dovecot-auth-lua dovecot-auth-lua-dbgsym dovecot-core dovecot-core-dbgsym dovecot-dev dovecot-flatcurve dovecot-flatcurve-dbgsym dovecot-gssapi dovecot-gssapi-dbgsym dovecot-imapd dovecot-imapd-dbgsym dovecot-ldap dovecot-ldap-dbgsym dovecot-lmtpd dovecot-lmtpd-dbgsym dovecot-managesieved dovecot-managesieved-dbgsym dovecot-mysql dovecot-mysql-dbgsym dovecot-pgsql dovecot-pgsql-dbgsym dovecot-pop3d dovecot-pop3d-dbgsym dovecot-sieve dovecot-sieve-dbgsym dovecot-solr dovecot-solr-dbgsym dovecot-sqlite dovecot-sqlite-dbgsym dovecot-submissiond dovecot-submissiond-dbgsym Architecture: ppc64el Version: 1:2.4.1+dfsg1-6+deb13u7 Distribution: trixie-security Urgency: medium Maintainer: ppc64el Build Daemon (ppc64el-conova-01) Changed-By: Noah Meyerhans Description: dovecot-auth-lua - secure POP3/IMAP server - Lua authentication plugin dovecot-core - secure POP3/IMAP server - core files dovecot-dev - secure POP3/IMAP server - header files dovecot-flatcurve - secure POP3/IMAP server - Flatcurve support dovecot-gssapi - secure POP3/IMAP server - GSSAPI support dovecot-imapd - secure POP3/IMAP server - IMAP daemon dovecot-ldap - secure POP3/IMAP server - LDAP support dovecot-lmtpd - secure POP3/IMAP server - LMTP server dovecot-managesieved - secure POP3/IMAP server - ManageSieve server dovecot-mysql - secure POP3/IMAP server - MySQL support dovecot-pgsql - secure POP3/IMAP server - PostgreSQL support dovecot-pop3d - secure POP3/IMAP server - POP3 daemon dovecot-sieve - secure POP3/IMAP server - Sieve filters support dovecot-solr - secure POP3/IMAP server - Solr support dovecot-sqlite - secure POP3/IMAP server - SQLite support dovecot-submissiond - secure POP3/IMAP server - mail submission agent Closes: 1144639 1146018 Changes: dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium . * Import upstream fixes for multiple security issues. (Closes: #1146018) - CVE-2026-27852: DoS by sending mail with bad header - CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return - CVE-2026-33605: managesieve-login: Pre-auth crash - CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service - CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT - CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c) - CVE-2026-40015: imap-hibernate can be crashed - CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c) - CVE-2026-40018: MySQL multi-byte escaping wrong - CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl restrictions - CVE-2026-42007: Sieve editheader RCE - CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command - CVE-2026-42394: sieve: symlink traversal flaw could result in arbitrary file disclosure - CVE-2026-52681: Sieve resource usage tracking lost when active script changes - CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage - CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks - CVE-2026-33606: dsync: Mail content can cause dsync protocol injection - CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text - CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy - CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages - CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons - CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes - CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path - CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim * lib-mail: istream-header-filter - Fix potential assert-crash (Closes: #1144639) * CI: Disable test-build-twice job, which is known to fail on trixie Checksums-Sha1: 682cc42689d47211a65861d9d80fe47f81f59df7 32984 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb b8767d13da6625fc2059f3982a1b4ec85b323bc5 23612 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_ppc64el.deb ca56b19bcd0a0ca4e3cbacf6777e2d380f863d87 10213248 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 96cd6e6292b2f04373a047fd8f03425153478d33 2831536 dovecot-core_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 5e5f205694fb84192960bd2fbc73fdff82f321bd 434224 dovecot-dev_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 2feeabcda7fa40e3ece28949bc42b5fda14373db 189528 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb ac6a99b941ce8733d88686670040aa37d168c2d3 44736 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_ppc64el.deb e50a155967f853a219ad00e2fae20f77f0e55cd5 21488 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 6aa18d254f7ae0c1c32601d0de63d8d98ff80ce4 20028 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 9c5b4ca08e51dd3bb8856a6ebc1938f74949000a 756796 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb d30a42cd05ed98aeca560ad9dc3c219c303aa354 208900 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 5edff5cd59c5505d6400a6d13ae4342209a58110 171936 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb abdcb10fd332caeee90af6ea1a2bc7d6c83b99f4 56760 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_ppc64el.deb de8867c99b69f149896a9b8fe116e22cadf6195e 102396 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 37844db84c9f45bbb1960f05b8ef68a064bcd2b7 39292 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 977e198db523bed58ddc4a5a2633cd676e203fab 120176 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb cd5fe1bb02b42a5f413c4312d31c0d11367c9aa8 50360 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 9d480377327e4627fcfaff32ac80ccc658c294e9 36384 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb e9d77b0c6f3d8e48eb89affcf4e3ee74ede81cf2 22408 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 558fa501331226572f1d9c3f82db3772b8bdb235 39644 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 14dbdfc675736dd17fb3aa06890d85875439ff5f 26780 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 4a094b27411bc066526615e4834c3bc2620a651d 107496 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 39d1f5fa2e9c0cc057eddaab4de6ccc1b1a32e29 48668 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 535dd6383118bdd0a1f8c29af4656dad1dc3b405 1718576 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 0f04616a921f61bf5d668ee812176b7f6d71e56e 397304 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 35a29a42bf74d5158d2904b4455cbc00c48c7501 75940 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 536ef3e78176bfa225c56deec2b1ae4b036d66b2 40496 dovecot-solr_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 78917edfe75ebc0ca95fa7f9290f1c83f2035d14 25312 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 60ad40bf9be4b20ab75f802afda2a244c93a4b45 21616 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_ppc64el.deb b4894ceef01c831c54a0a10182108f16128f7e55 211244 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb d31454f9723cf0c403f3e0f917c28126f6454585 65088 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 7f84a0d86b620b9d1391f55372c855f7534063dd 18435 dovecot_2.4.1+dfsg1-6+deb13u7_ppc64el-buildd.buildinfo Checksums-Sha256: e93fd632eef5625d0198b6eb8a7bd853d1c37a928c8461b4f4ffd2899c87b9ad 32984 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb f48d954d6a7442988cf223635236c60ade486ae682e68b763dd4ab59f463df80 23612 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 34fe706f677b3114819e886c72a679bfc82358bc20f51c6e3949030077c5b6eb 10213248 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb e88ac87ec4b62ba4136bdcd3aecb568c56bc8dc47e20e69b4079bf045079b8e9 2831536 dovecot-core_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 8698ea29cd58ae66af3173623863057ef859ec7df9d19d3d30f804bd4dd9497d 434224 dovecot-dev_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 1d41610f427d6a3a6ff67ef4e26a2ea914df121930cc88eb8c559fead8a94fd0 189528 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 13fd7ff49e721179a9fe9031cb1581c5521bbe2c305f1ab0632c3322092cb6d6 44736 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 826fde2a547e3487370e26b8056076dd21b702cf757385ac6f97eb65914e9fb6 21488 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 9d4cb96370acb9d0816d0c5a469667eb034113a6f419adffa1cfffc69b792f35 20028 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 10c63130a808590c625914c565203fcf6c4bda77ca721fb70c3ce81420d2eb66 756796 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 5f9c24d4c834b48c0e83296d78d8a5df3c186fbcd1f2bb4170977e76abfff4a7 208900 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_ppc64el.deb c7471e1add5993906fb9c902ccb364231b576d7275b07efc95da07a7daa4ae4b 171936 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 873cbb1af14c62bd5949eb1457a72bfcc66a8f9d86e592613987361fe625c0a4 56760 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_ppc64el.deb a2dc912ea90c625c8dd619883bd7a698741cc6b7a42161b297438d0af1c289ec 102396 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb bceb2aea92757a396edc2dc56fa584e77e9660e51ca9d44a9f637cad75e55d5a 39292 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 98e533cadfb262f6910b18efd4af39db0dedf65c70566a60d5ed37825a7104a2 120176 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 2d94901319575f3799817bcdd2befff625b1663a8258b45edfb9fa833dbeec0b 50360 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_ppc64el.deb e97cd771b3bd515e2eedb8ffe85cd4cd5d8697f0abd80de528ffa34605045773 36384 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 79ef5e1b130f48af423ef547ad442860c0bd2d78c0509c5c9c440302dea58fed 22408 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 4665ec835d17911085b5b449b23ae58a21e950b57ebcb640c055798f25e39100 39644 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb a8b22d29beafeb9c784c86b6acbf76b06f0845b4fdcf11fbec23e9cafcbae6a0 26780 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 9bfcacc619e1f93145ef3dd01059acc97220329bc56f510308cc2cb3a48a9f93 107496 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb d653b11b536c4e36ecc2733651730254cd08b6b1b30a3d5a0a52a68e4f5347f2 48668 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 26e4a1158465cc7e757f3f18609979b92cb399f38eb36d8bb07835020143251b 1718576 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb fe84bde36ea6ccdbb06739abf28c50dad1faa016a1dd33a2f386b312979e9c03 397304 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_ppc64el.deb b4bfb685f89ec13a7f625d3697e8b897770f3b42a884e556e9b240193b369eff 75940 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb c34387f2b8319d6fdd45a39dfd144b335e63f63ad3c9948663fd33b8a1daf3c4 40496 dovecot-solr_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 2ff7ada61756b3f2bd12f6ad6056ea492c75e228983e2a43a3b0883871bd4807 25312 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 24ba92292a59693204a90d346e4c3c087f7ca725051f26f5cccd11f30e4893b1 21616 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 1237701566534d5eda88a8ca795db4ce1e91de769ab36aca49aac531d85dc79a 211244 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb ac7c7b752a711a55af23d4c7ba97f9c8735b7678e71131c899d7054d4380b43d 65088 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 3b41d826cf9ce7d8cc7883bf6ae65e6299ca90118c8aaae45b23ab9ada82f026 18435 dovecot_2.4.1+dfsg1-6+deb13u7_ppc64el-buildd.buildinfo Files: 5607891abf9b100db013de001ede9f63 32984 debug optional dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb ee2ad8e7f3f26aa615032dd4c2dd3ade 23612 mail optional dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 15c6f9de4df460aea6bfd98872162e2a 10213248 debug optional dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 2fde1d4552269dda25dd7d9b70783c11 2831536 mail optional dovecot-core_2.4.1+dfsg1-6+deb13u7_ppc64el.deb ab990d11cd3a33c824e79d78200946c2 434224 mail optional dovecot-dev_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 561efb16d4b638155e2ec6b1e78771ba 189528 debug optional dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 9e42383065c66a8a0044145f2b79be14 44736 mail optional dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_ppc64el.deb b4c20a61cc181fe2984deb5b877a6b78 21488 debug optional dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 175294618b68b0ad3ce1cfeae1305699 20028 mail optional dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 16db8ec49298e624f4e439928c8b0ca1 756796 debug optional dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 4046acf057c2d257d9ddeb7c22ea0865 208900 mail optional dovecot-imapd_2.4.1+dfsg1-6+deb13u7_ppc64el.deb e7258eac425214be37c747e49af2c1ff 171936 debug optional dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 6f22b63e3a281cea726490872be4a638 56760 mail optional dovecot-ldap_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 83ef8f2690f652be897770dd6b54c9ed 102396 debug optional dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb fac2b65032edf9710fd83ecd07262b3e 39292 mail optional dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 40ca151f73629a8ee19f8b8a27fda92e 120176 debug optional dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb d0ca3b25ea58052a0a82f88c3c6df578 50360 mail optional dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 4ccb6c317f82ef0b17ae5b446ac8df5d 36384 debug optional dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 41b41ceddd3563c6a95fd75d2a963c99 22408 mail optional dovecot-mysql_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 23e1ac6cf3ab73623fa0cc5099baf968 39644 debug optional dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 6f5bb3e1d1b4f05670247ff311315052 26780 mail optional dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_ppc64el.deb bd622919a41013a78784de3bd2d5336e 107496 debug optional dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb e293dddbb8db10169fe22249327f284d 48668 mail optional dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_ppc64el.deb dd34cfb38c952357640c0f5b7d5023c7 1718576 debug optional dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb d7410cf9e7f1442736942b4c5fcbbbd6 397304 mail optional dovecot-sieve_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 191840fb1f068e610387930b191ff20d 75940 debug optional dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb aec88703c28d944d627c5ed21a9c6172 40496 mail optional dovecot-solr_2.4.1+dfsg1-6+deb13u7_ppc64el.deb adaf3d5d945a30ab6721cc23569c9cf6 25312 debug optional dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb dcda2ecdd523868c3db27fdca5a26fd7 21616 mail optional dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 8981f1013444de2fa07919d238f9f718 211244 debug optional dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 5b47561d5f56202f5f7e6d9d65aba92e 65088 mail optional dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_ppc64el.deb 94e004d2ee155ff4b02fb3367d79ab9c 18435 mail optional dovecot_2.4.1+dfsg1-6+deb13u7_ppc64el-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDoRc43uRWMOoIqIgDNLUPhbmg7MFAmq5IsoACgkQDNLUPhbm g7NhCQ/8CTSJy2QY4dBfVtJCVEiUcsMgMzAE6JiGw8tqOBUgFJv4bXxlzXWi57D/ Xaf84t13J0DLy+BrSFPmZyHzjl/VyLtbqCn3aEYrpWIhRI/kOK8C7YWviWv2kjIt Q/fwN2wN6iB3YU5VVB9O/VLH0+/xHc43e9a4UgjenYN4IElqv+SvSnf1QUIrUa5Y Yl5ovpSEskF1gWp7M6MOtuGK+3mD/jcjG6CrU34KbDlH/Pu7lQV+gIsc6/Fgu1Ey JC1xSvmMhybr/BeFNdcBQo1QefrCMfMVtn80oEUnCVqJGacamasY9FgCKQyPTIBs 6ImXukrGk13YGxGTZ5JTXjAFiAgbpimUwIFT6ejcOhSxBPvZQ2TFe+xBCZS/Wqbz JPLabtnJIvO4nalRLM+9Y2eYrDbRKe+EYKFfbNPuAQPoaH7GWT50l9t5S5/CGOkd TqM9unZNP/eRgmeL40C4hXdgJLpd183bBCN6YpFqUTLDCktow8wld4nZs0F3wkih s/n2114DBuED/OvKWc6yID2D2aVmxScz1iiI/z6xEFqmaXPsDclNAYRAxNDZasWv CDNntEPEXkHbZzRfwTUR6FJBBsJC0xiYh4Gbko4ZyggVRsB3THXDG0anxtraAZJF 1AS/uHa8BXvJh2oDN0huVzZ92IX3UPihU9fshOcEzzKT1CMUQ+I= =SW96 -----END PGP SIGNATURE-----