-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 16 Sep 2026 15:06:35 -0400 Source: dovecot Binary: dovecot-auth-lua dovecot-auth-lua-dbgsym dovecot-core dovecot-core-dbgsym dovecot-dev dovecot-flatcurve dovecot-flatcurve-dbgsym dovecot-gssapi dovecot-gssapi-dbgsym dovecot-imapd dovecot-imapd-dbgsym dovecot-ldap dovecot-ldap-dbgsym dovecot-lmtpd dovecot-lmtpd-dbgsym dovecot-managesieved dovecot-managesieved-dbgsym dovecot-mysql dovecot-mysql-dbgsym dovecot-pgsql dovecot-pgsql-dbgsym dovecot-pop3d dovecot-pop3d-dbgsym dovecot-sieve dovecot-sieve-dbgsym dovecot-solr dovecot-solr-dbgsym dovecot-sqlite dovecot-sqlite-dbgsym dovecot-submissiond dovecot-submissiond-dbgsym Architecture: s390x Version: 1:2.4.1+dfsg1-6+deb13u7 Distribution: trixie-security Urgency: medium Maintainer: s390x Build Daemon (ziehrer) Changed-By: Noah Meyerhans Description: dovecot-auth-lua - secure POP3/IMAP server - Lua authentication plugin dovecot-core - secure POP3/IMAP server - core files dovecot-dev - secure POP3/IMAP server - header files dovecot-flatcurve - secure POP3/IMAP server - Flatcurve support dovecot-gssapi - secure POP3/IMAP server - GSSAPI support dovecot-imapd - secure POP3/IMAP server - IMAP daemon dovecot-ldap - secure POP3/IMAP server - LDAP support dovecot-lmtpd - secure POP3/IMAP server - LMTP server dovecot-managesieved - secure POP3/IMAP server - ManageSieve server dovecot-mysql - secure POP3/IMAP server - MySQL support dovecot-pgsql - secure POP3/IMAP server - PostgreSQL support dovecot-pop3d - secure POP3/IMAP server - POP3 daemon dovecot-sieve - secure POP3/IMAP server - Sieve filters support dovecot-solr - secure POP3/IMAP server - Solr support dovecot-sqlite - secure POP3/IMAP server - SQLite support dovecot-submissiond - secure POP3/IMAP server - mail submission agent Closes: 1144639 1146018 Changes: dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium . * Import upstream fixes for multiple security issues. (Closes: #1146018) - CVE-2026-27852: DoS by sending mail with bad header - CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return - CVE-2026-33605: managesieve-login: Pre-auth crash - CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service - CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT - CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c) - CVE-2026-40015: imap-hibernate can be crashed - CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c) - CVE-2026-40018: MySQL multi-byte escaping wrong - CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl restrictions - CVE-2026-42007: Sieve editheader RCE - CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command - CVE-2026-42394: sieve: symlink traversal flaw could result in arbitrary file disclosure - CVE-2026-52681: Sieve resource usage tracking lost when active script changes - CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage - CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks - CVE-2026-33606: dsync: Mail content can cause dsync protocol injection - CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text - CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy - CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages - CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons - CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes - CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path - CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim * lib-mail: istream-header-filter - Fix potential assert-crash (Closes: #1144639) * CI: Disable test-build-twice job, which is known to fail on trixie Checksums-Sha1: 3deca235ba3af26c0ccdf6aba5a20a83e9bb3873 31868 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 4b3c3fcdb958f036479362f81b601e0d021cb13c 22392 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_s390x.deb 644e87a9fe34bb3711135324dc616f624f1c9ccd 10156008 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 133fdbb377669ad7791e32d98c8cd41c9adb0921 2570140 dovecot-core_2.4.1+dfsg1-6+deb13u7_s390x.deb 3fb837072a8ebce807ee97739a774dad7ac56b6c 434136 dovecot-dev_2.4.1+dfsg1-6+deb13u7_s390x.deb 6ae40e827d0291c4d909af11daf2c9165b544752 187804 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 7e6504e10ca2a706be5b92b82fef5f297b0c7dab 42304 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_s390x.deb 2f71e3de095821f062b39a4889c2284c106cbad3 20812 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb c90425f5693c8363a288a02074213f19b3864762 19164 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_s390x.deb 021b62aec4322be0e0c12ceaeceb7f71c3c49d19 749824 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 6ed874b34f6fb87787dc9b87fd09fd33a2b0cba0 185384 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_s390x.deb 045594e47b591581de33296faec24182247274ee 167212 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb b893d0d696d7a90e9a6d381af8a83215f242f5a8 52880 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_s390x.deb 04cf04c48b16d4a3331d1a936b5d68cd20139b71 100412 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb d76156509b8ca5b301202810941957e5a166d563 36568 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_s390x.deb a3d36ca7dfbe01c7ae158d8e24876dbe2c5aaf42 116656 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb add8512841bcdddb7ef1ea1c3b5f88bcb7ec62f4 46704 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_s390x.deb 23c6c6c52562efba47ee2cc22f11acc038a216a6 35176 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb c8338db0e14947a2d29aacafd16ad908fd6ec92e 21616 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_s390x.deb 529b8c6ed2b523fadb9ca7998dae11a63ccdb5a6 38752 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 01cf3e587dfa3674cc40eda017bc125d7d704800 25200 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_s390x.deb e4f883a9d704263c6f607659034eed254d9df189 103160 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb eddff7f54b6b6b955a7db9f9b7aee2ee7cc92bc4 44344 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_s390x.deb fe280e8d96ef7783da87b2e0dcd195f822169b82 1712800 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 9dd70820de7f73064a6bab4d38fc724fc2e39d21 361468 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_s390x.deb f140686d8ed8c980bb2a5748049d2400bfd9c3c5 74552 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb c3f478b3f5799da437e1e09781c80d337b02c9b6 38488 dovecot-solr_2.4.1+dfsg1-6+deb13u7_s390x.deb be70192f6822c7e385ce7c6c5e191f2b96bad931 24548 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 6e3c6b22807b01a2b9a31cfdf6134ef12528c236 20540 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_s390x.deb e6c66719cc4a04f0735a3238da2550d8cf1bb625 207428 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb ff12467648eacd3ed87a9b627c33e6dd16b20313 58800 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_s390x.deb 4619ef2fdd8554258afde753344e1053394e5044 18124 dovecot_2.4.1+dfsg1-6+deb13u7_s390x-buildd.buildinfo Checksums-Sha256: 5abe8c4e016028ac5bef749cb8efabe02020bf1521ce66ce9b7cbb175709b89e 31868 dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb d6600329462f5392e915ed4fdf0b5cabbc19129a399324a205725c1c2ccdc2c3 22392 dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_s390x.deb ff94ad5e4380a68160af35e4a6aa40054e17865b26c3ab11ff81a3cb48c0a232 10156008 dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb da4c9fa73c617bab69d3b82e38d2e4fc8eefa97b85f4c5fc332550d2ee71ee8b 2570140 dovecot-core_2.4.1+dfsg1-6+deb13u7_s390x.deb 9f1eb60161540d11b2a796bfb4e5acafe10fd35197e7d1140219128244629961 434136 dovecot-dev_2.4.1+dfsg1-6+deb13u7_s390x.deb b7da5534df0d5b8c5b185a5e5f1f60eb7be2d766cf4ad3a82022447adcbfbec7 187804 dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 81a8dfb267a10e402f263bcbfb3bedfcdc16bb443ccb1b21f1e080ecdf92b0e0 42304 dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_s390x.deb 48c8539295f2a20edce0d0a1f7f6ea391d2ccc877102e6a375461a6414c4416c 20812 dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb c99e4e144a8bd751d654ef05c41c29ab1de99ef661c9bc8a7a8d280bf7b6ea35 19164 dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_s390x.deb 3a369eac77f404eda743d6d193c55f3fd128240667f26e8e75961ebac281181e 749824 dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 70bd0ba8a7608b45173f97d2e95c7ce889e01c9ba9d2e19b13d5f276adfec0bd 185384 dovecot-imapd_2.4.1+dfsg1-6+deb13u7_s390x.deb 404a5aeca0b316f2b3ec439dc78f7149062e7db066d74e45fe5f69f5476c5111 167212 dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 93c470711ce7411ec1cf820fecf0e7be91c6366d54958d558ca0666fa7ebd8e7 52880 dovecot-ldap_2.4.1+dfsg1-6+deb13u7_s390x.deb 9d38c43fdf937155b9e8113b0be40c610cae06875dbe4688b038b6527626d633 100412 dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 42587e564e72f9e6e79f056623c41525ea5158d2bfb826afe9c0b93ba93735cb 36568 dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_s390x.deb 60d2d174b5c5050e9c641ede60ba695bec62dfd83e3e5973168ca30c0fb131af 116656 dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 4883ec67ebfabdea46dd23e94e355ce050fe2815f1f84a7a526eac0123d7f144 46704 dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_s390x.deb 45fb5235c6c4e7017d6802f85776c0bef3d07740fd9a25ba08dde87b7a43a154 35176 dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 530cda7e2386ce54768f68bb2443b8ce260215a4532da10d6099333a39b492ed 21616 dovecot-mysql_2.4.1+dfsg1-6+deb13u7_s390x.deb 015b06641db254eb53f5e1e57e7272c46bfe14bcc4dd082d392a99c049569e1a 38752 dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb c653c4a8f700d53ae75c9154832dd6a8d610afe656d4e60b4219602d02286579 25200 dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_s390x.deb a1214e1ee55b3d5e72a8df57005ff9590cae3d1d83005808e5292a2a7d39ae9f 103160 dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 0a88fba82b1bdfb0db58239cb01493a7a2f75be9f69af24ed7dabb3b61e52da7 44344 dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_s390x.deb faa0da174d068447731637c374a0c9211e33aa5bc3f4e83a422946b1e361ef58 1712800 dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb a7ad65cc55fc6734a02b9caa8cc165e04570b75660d116783f99c2b6d16a1bb1 361468 dovecot-sieve_2.4.1+dfsg1-6+deb13u7_s390x.deb e0b884429959c4ff811e8d8ab6c18148fddf05b39f80a919f4854675e61b66fb 74552 dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 549d1a3c9bddffda6186e4b787860d139d8607e17598ffa5d75e3d3bedcfb005 38488 dovecot-solr_2.4.1+dfsg1-6+deb13u7_s390x.deb 05378bf93bbc85c8748a0e10423a48dd5cf61afeb8e97dc3d3424d4e71a3e3f6 24548 dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 60c514504502447dc24212b0f975a35ffdd41160cffcc202d79f163ee5afe380 20540 dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_s390x.deb 40b3135ad235bb515bf47f30c631dfb4a013e49ea61c778873e51a69d83cd0e4 207428 dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 18f01b4ae81d2221e2d08c69a7eacff1e1e965e6f9c957ed8e78e5eebf83064f 58800 dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_s390x.deb 1d7a1a1b6d5a3398c84416e1455c792f895303f0f664c64cc98a9f5d46edadb3 18124 dovecot_2.4.1+dfsg1-6+deb13u7_s390x-buildd.buildinfo Files: 43dd8fd14ba219d611058b112d548c4d 31868 debug optional dovecot-auth-lua-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 1e21e04f339bf60b6120bf5d069a8d08 22392 mail optional dovecot-auth-lua_2.4.1+dfsg1-6+deb13u7_s390x.deb 9bcb0f9416a011c06b0da5a1b5b24f57 10156008 debug optional dovecot-core-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb e8aa960f559275a440396422b8962be5 2570140 mail optional dovecot-core_2.4.1+dfsg1-6+deb13u7_s390x.deb 1bfdfe5fcb0c3a122997b92f87871b60 434136 mail optional dovecot-dev_2.4.1+dfsg1-6+deb13u7_s390x.deb 510c00dd12261c83c61be79dd1865227 187804 debug optional dovecot-flatcurve-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 0e1339d371b1973a282aeda4eaeda026 42304 mail optional dovecot-flatcurve_2.4.1+dfsg1-6+deb13u7_s390x.deb bde9842283b2736d6ec4aa10ad139e19 20812 debug optional dovecot-gssapi-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 78bab8d2b02022136b8684c816002204 19164 mail optional dovecot-gssapi_2.4.1+dfsg1-6+deb13u7_s390x.deb 9f96cfaabf5adc0c9180e055c6540155 749824 debug optional dovecot-imapd-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 07b41a0459067b6a2dd9d7a02fd37a7c 185384 mail optional dovecot-imapd_2.4.1+dfsg1-6+deb13u7_s390x.deb 35be88f4b656d917702dc5b09493f0ba 167212 debug optional dovecot-ldap-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 6705d3740042fb389cb9410fbafe39fe 52880 mail optional dovecot-ldap_2.4.1+dfsg1-6+deb13u7_s390x.deb c2f54b65adbe2823e12c9d86f368133b 100412 debug optional dovecot-lmtpd-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 495288f67cb7d64417759db7e5a88b52 36568 mail optional dovecot-lmtpd_2.4.1+dfsg1-6+deb13u7_s390x.deb e61bb7f0fe51f80e3c8144b376f01a5f 116656 debug optional dovecot-managesieved-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb c69c9df5eeb9e59b54f8dc6b2e140665 46704 mail optional dovecot-managesieved_2.4.1+dfsg1-6+deb13u7_s390x.deb 259da1ff10ce112b6cd07fd152f7cdcc 35176 debug optional dovecot-mysql-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 9d9e90a994e5b716feb7dae462406fcb 21616 mail optional dovecot-mysql_2.4.1+dfsg1-6+deb13u7_s390x.deb 49a6227fe7f9d4a477be520f1ab648d7 38752 debug optional dovecot-pgsql-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb f605b421afe9b689e7d35bddd3491259 25200 mail optional dovecot-pgsql_2.4.1+dfsg1-6+deb13u7_s390x.deb 65d0e136f5dc540b311a5f21ae6c1b9d 103160 debug optional dovecot-pop3d-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 605e19e8c8f73c1790dd6cc3f76a6609 44344 mail optional dovecot-pop3d_2.4.1+dfsg1-6+deb13u7_s390x.deb ac3432d4409158163967da41a9501b25 1712800 debug optional dovecot-sieve-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 626cbec22190c54bc2a285d81f53c75e 361468 mail optional dovecot-sieve_2.4.1+dfsg1-6+deb13u7_s390x.deb b0b89b9dc813e764ae394c108950ab0e 74552 debug optional dovecot-solr-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb e37ce73e5c3015f846ba2719d09ab68f 38488 mail optional dovecot-solr_2.4.1+dfsg1-6+deb13u7_s390x.deb 24975aaef0173cee7011ddec67fe58f1 24548 debug optional dovecot-sqlite-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 350f67f5b05e53ddf24dee6b9444827e 20540 mail optional dovecot-sqlite_2.4.1+dfsg1-6+deb13u7_s390x.deb 824bb9c62d2e63efd734d48866c74fe3 207428 debug optional dovecot-submissiond-dbgsym_2.4.1+dfsg1-6+deb13u7_s390x.deb 266e747418323300401e1fdc4aa99d72 58800 mail optional dovecot-submissiond_2.4.1+dfsg1-6+deb13u7_s390x.deb 3a80fe328fadd1f3226f134877eff870 18124 mail optional dovecot_2.4.1+dfsg1-6+deb13u7_s390x-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEl0BM/nR+Oj597wRWMWUFebkHnoQFAmq5IaEACgkQMWUFebkH noSuzA/8CftxFPZSo5uq8NhWIk9thVxmm4pMUavkZqwxdCBBAmZEwFC+oNe0/Hxa duxJI1SAPmo7RIjlSjWaTxIb7QyV5Edw81UMBtBernkDvnlu8zfP0tgui4L+I2dc ACPNNVcLh2v4D8KR4HyOHsWkizfLwbMCU7IgisXMcmelNQfeHmEBvlq7vRT54G+2 btqmfKI1mS1iYMYSM5AjTobK/grlCtF95cDXGSOwT9/hUiBE10Nu4e/L+DNIu8GN HGZn2izUg/XX09FsJzjU4M0JRyqQQnX6KNoRUypLK3dX7aIcbMibkUvnixdvRZGo UPjyuK0Vt+/ghnbQhyAtnl3fHwHZTBWHgc9/I8Jatj2TnV/x/99oj8bLC/krz00D vVV86UEdLcatzNwD07p3jSTSdQ9Lyh66nsvBZlDfB1eB1iPkHzPyMjxvCkP2PiTe ayUejaf6XH4dHNI3XKH3v3caNv7Zfm0ZIAKKWAUlBKVMoRxgJDFkpqqNXMSx815/ mMNs4dTrk/UTxAYc3E3wxPzSTqniROR17gp2Pm7zbqcztSbxFrry7bj3RT8nNzYI OYdy+nyCMKt2JKjtsLdb5543JjeykLtMsuAaa4UhBCJgMxzAio0h00W/8xv00cBW 9AAb6aT+pN7TfeVVBfEEOauM95ZS5YLp2cSIKVPolPgjQWG1JxA= =JD6V -----END PGP SIGNATURE-----