Red Hat Product Errata RHSA-2026:17628 - Security Advisory Issued: 2026-05-14 Updated: 2026-05-14 RHSA-2026:17628 - Security Advisory Overview Updated Packages Synopsis Important: dovecot security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for dovecot is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) dovecot: denial of service via crafted message before authentication (CVE-2026-27858) dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.2 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x Fixes BZ - 2452172 - CVE-2025-59032 dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command BZ - 2452175 - CVE-2026-27858 dovecot: denial of service via crafted message before authentication BZ - 2452179 - CVE-2026-27857 dovecot: denial of service via specially crafted NOOP command CVEs CVE-2025-59032 CVE-2026-27857 CVE-2026-27858 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.2 SRPM dovecot-2.3.16-8.el9_2.2.src.rpm SHA-256: b3988b98b89f17390801302b6335a02ac8dee2c965bb8bfaca63272fc7f4ab86 x86_64 dovecot-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: e19b7f1fad30aec960e7a4c5cb216a50413ddffbcd7ac49c26792cccf9925c3a dovecot-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 2f8a56b5b8e496f4515e16c1625a26b63991c2b5fb4b014c45350b7a1a5888e7 dovecot-debugsource-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: dba38b44a12185f25ce4a7a0a56dfff1d4bb926e79d16decf673187ab9c1d5c6 dovecot-mysql-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 4c09d4eb6a234d17fbc8835d233666d90681b36ea43b229c20b4ca52de183a8c dovecot-mysql-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: d18a44ec3df526a3feb73b5610da8e712a53a223ffcb8aa38d80aaef809e0e2b dovecot-pgsql-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: e7c684981834c521c9dab2ee5e248f514366b9197c7b2b3651dc3e5b92614492 dovecot-pgsql-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 526e228ba0be5efc0594748edada4fdd35f7039999ff69754fa0c87003c3bc5c dovecot-pigeonhole-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: e16bcbc3ac88640d3a2180e5bd3497ca1254d89b05bb6af4d1dad1c8e2ec88db dovecot-pigeonhole-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 6fa32d94f8c3da30981e52c7b5e5060fe4ced319b19641da991b5d8a46feb71e Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 SRPM dovecot-2.3.16-8.el9_2.2.src.rpm SHA-256: b3988b98b89f17390801302b6335a02ac8dee2c965bb8bfaca63272fc7f4ab86 ppc64le dovecot-2.3.16-8.el9_2.2.ppc64le.rpm SHA-256: db5b7849a382e815019996df5e575a14299138cc0ad94c7add563bd391a825a5 dovecot-debuginfo-2.3.16-8.el9_2.2.ppc64le.rpm SHA-256: bdc39f15881d31b58794d4b8cc081341e4713a40818cad3df4dce45256710c80 dovecot-debugsource-2.3.16-8.el9_2.2.ppc64le.rpm SHA-256: f530dad4b829dd25867fda5926cc4abe0f34802d344c3c0534e438bc5e175b32 dovecot-mysql-2.3.16-8.el9_2.2.ppc64le.rpm SHA-256: 248ae7e907b4c976ea0f8b86557a9a50bdcd13eb4ce2dc01d683b190905b9a5d dovecot-mysql-debuginfo-2.3.16-8.el9_2.2.ppc64le.rpm SHA-256: 94c6d0133ba5315c91a9a2fa1fc5c2b9f172dc744606fae24e873dbacae112da dovecot-pgsql-2.3.16-8.el9_2.2.ppc64le.rpm SHA-256: 69ba233c87f4b213bed65fef2ec20e8856f539543137ee2d8dcaf746e1d8a6a2 dovecot-pgsql-debuginfo-2.3.16-8.el9_2.2.ppc64le.rpm SHA-256: 6488a82f0d6c46e846812dca08067ea97287a4e54b58534a025ea7260613c291 dovecot-pigeonhole-2.3.16-8.el9_2.2.ppc64le.rpm SHA-256: e0dd7747e65b8b043a743cc24e89ccdf57f92ab0e0155d27760861fe8add5f6c dovecot-pigeonhole-debuginfo-2.3.16-8.el9_2.2.ppc64le.rpm SHA-256: 9ff2600ca3a84b8e3ac4668878eb32f17e484d794731050ab79e6bf81583d99e Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 SRPM dovecot-2.3.16-8.el9_2.2.src.rpm SHA-256: b3988b98b89f17390801302b6335a02ac8dee2c965bb8bfaca63272fc7f4ab86 x86_64 dovecot-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: e19b7f1fad30aec960e7a4c5cb216a50413ddffbcd7ac49c26792cccf9925c3a dovecot-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 2f8a56b5b8e496f4515e16c1625a26b63991c2b5fb4b014c45350b7a1a5888e7 dovecot-debugsource-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: dba38b44a12185f25ce4a7a0a56dfff1d4bb926e79d16decf673187ab9c1d5c6 dovecot-mysql-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 4c09d4eb6a234d17fbc8835d233666d90681b36ea43b229c20b4ca52de183a8c dovecot-mysql-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: d18a44ec3df526a3feb73b5610da8e712a53a223ffcb8aa38d80aaef809e0e2b dovecot-pgsql-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: e7c684981834c521c9dab2ee5e248f514366b9197c7b2b3651dc3e5b92614492 dovecot-pgsql-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 526e228ba0be5efc0594748edada4fdd35f7039999ff69754fa0c87003c3bc5c dovecot-pigeonhole-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: e16bcbc3ac88640d3a2180e5bd3497ca1254d89b05bb6af4d1dad1c8e2ec88db dovecot-pigeonhole-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 6fa32d94f8c3da30981e52c7b5e5060fe4ced319b19641da991b5d8a46feb71e Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 SRPM dovecot-2.3.16-8.el9_2.2.src.rpm SHA-256: b3988b98b89f17390801302b6335a02ac8dee2c965bb8bfaca63272fc7f4ab86 aarch64 dovecot-2.3.16-8.el9_2.2.aarch64.rpm SHA-256: 81c730ecc4da0b444035bcc6b7bfed6642c464b7923d0252382cfeee47c21a38 dovecot-debuginfo-2.3.16-8.el9_2.2.aarch64.rpm SHA-256: 978732e4f6d6419704afd670968c920bc356f30f8de6088f7b9bd46c0d8316c9 dovecot-debugsource-2.3.16-8.el9_2.2.aarch64.rpm SHA-256: d272497babf5aec503c5e5ab1bffdf0d95560b87772baef43c8d862658611584 dovecot-mysql-2.3.16-8.el9_2.2.aarch64.rpm SHA-256: eab903f6d1b3265dbcdb6e9119aedeadf10faf666317ac5fe332c96a23fe623e dovecot-mysql-debuginfo-2.3.16-8.el9_2.2.aarch64.rpm SHA-256: cf6574d8ff6c2b5e60580794f2e7cc94ad8b941d7354c94cab6eb293037e98a3 dovecot-pgsql-2.3.16-8.el9_2.2.aarch64.rpm SHA-256: 5b8a97f07f78368a2f1184a6caa4b88b0a9e919c5800f5e961c2e9ac0989eb24 dovecot-pgsql-debuginfo-2.3.16-8.el9_2.2.aarch64.rpm SHA-256: 26d43d8eddee51f7ac7a33fa3cdef49d440a12f0b3e9145819d05f4df74b228c dovecot-pigeonhole-2.3.16-8.el9_2.2.aarch64.rpm SHA-256: f9a77a991ffdfdc7ae253abc5bd405598ef9cd8423c579bbcc6dc29d7e828145 dovecot-pigeonhole-debuginfo-2.3.16-8.el9_2.2.aarch64.rpm SHA-256: dec452e9669cf4c36b173c5efa893f763e90663170d410fd617726e2febf63fd Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 SRPM dovecot-2.3.16-8.el9_2.2.src.rpm SHA-256: b3988b98b89f17390801302b6335a02ac8dee2c965bb8bfaca63272fc7f4ab86 s390x dovecot-2.3.16-8.el9_2.2.s390x.rpm SHA-256: 4b6aab9ae2c1f5065cd31459253ba7acc639e2f2831eeadb5944607b7fce6607 dovecot-debuginfo-2.3.16-8.el9_2.2.s390x.rpm SHA-256: 2270a77dbb487dfbe75b5f84e6ba90ba9e284e88aae9fa5143d24fd592141129 dovecot-debugsource-2.3.16-8.el9_2.2.s390x.rpm SHA-256: fa4d22dd51d2a00e62b00452785a0b35944eba23ec776761dd9b9a5e08186602 dovecot-mysql-2.3.16-8.el9_2.2.s390x.rpm SHA-256: c2ce43cc48078470a2aa02246a3fc4f06505168f4d70db61295b3af56152ad9b dovecot-mysql-debuginfo-2.3.16-8.el9_2.2.s390x.rpm SHA-256: 9adc4ce7369b1325f978e142951a44864e1541d7e3bac3a6c756b936204d3785 dovecot-pgsql-2.3.16-8.el9_2.2.s390x.rpm SHA-256: 302c15722acdb0f6c29341471d5935a32d4b623445191a56194449ace857e729 dovecot-pgsql-debuginfo-2.3.16-8.el9_2.2.s390x.rpm SHA-256: 54aa306d96272fa66bcde5388e0ff95a140891cb20dbf6ff31f67012abd02bcc dovecot-pigeonhole-2.3.16-8.el9_2.2.s390x.rpm SHA-256: b783e5be7bdfbb58bb6f8c97bcb341abcaf5ff7ec866cfd10cf9c3e9ae84b0fc dovecot-pigeonhole-debuginfo-2.3.16-8.el9_2.2.s390x.rpm SHA-256: 364957edd75b2551d08fffe2e6fd564e6de337c0392a91a95c05c7edde6ce100 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 SRPM dovecot-2.3.16-8.el9_2.2.src.rpm SHA-256: b3988b98b89f17390801302b6335a02ac8dee2c965bb8bfaca63272fc7f4ab86 x86_64 dovecot-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: e19b7f1fad30aec960e7a4c5cb216a50413ddffbcd7ac49c26792cccf9925c3a dovecot-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 2f8a56b5b8e496f4515e16c1625a26b63991c2b5fb4b014c45350b7a1a5888e7 dovecot-debugsource-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: dba38b44a12185f25ce4a7a0a56dfff1d4bb926e79d16decf673187ab9c1d5c6 dovecot-mysql-2.3.16-8.el9_2.2.x86_64.rpm SHA-256: 4c09d4eb6a234d17fbc8835d233666d90681b36ea43b229c20b4ca52de183a8c dovecot-mysql-debuginfo-2.3.16-8.el9_2.2.x86_64.rpm SHA-256