A Denial of Service vulnerability (CVE-2026-42006, CVSS 4.3) in Dovecot allows an attacker to crash the service via excessive IMAP bracing commands. The vulnerability affects Dovecot versions prior to 2.4.4 and Open-Xchange Dovecot versions prior to 3.1.5. The fix requires upgrading to Dovecot version 2.4.4 or Open-Xchange Dovecot version 3.1.5.
Red Hat Product Errata RHSA-2026:46380 - Security Advisory Issued: 2026-07-27 Updated: 2026-07-27 RHSA-2026:46380 - Security Advisory Overview Updated Packages Synopsis Important: dovecot security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for dovecot is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64 Red Hat Enterprise Linux Server - AUS 8.4 x86_64 Fixes BZ - 2476476 - CVE-2026-42006 dovecot: Dovecot: Denial of Service via excessive IMAP bracing CVEs CVE-2026-42006 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 SRPM dovecot-2.3.8-9.el8_4.2.src.rpm SHA-256: 102baceafa070b04508fdaf265cb134b1536a665ad74f98f89a8619283434da3 x86_64 dovecot-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 778f6d9b6846baae37b8b84eac5764f0177a7bef8c00e7891675397d9df812d6 dovecot-debuginfo-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 7272eb9dcf56fc9cdd2a8add8ef0f79cb6742576df535386501b0d39dbf753bc dovecot-debugsource-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 6395836b086ef2cf5b45bd3c40a506de3f53bfa6e627a6c472936c95d6819673 dovecot-mysql-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 925c802eebc7e3d76688c17414a37cfb34cc07ba34f66e04e4d9c54a7bf7fcbe dovecot-mysql-debuginfo-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 9aa62e02b6d039a23eca359004f048e92a207299deec3b60d6d1a88abbd0001d dovecot-pgsql-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: fc1c227069078f18345bf47a07c1bac78520978a6c52296f63c615be6d6039a4 dovecot-pgsql-debuginfo-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 55f021d056284c53d8590887fe7223c46f4559a32b0393d3d6bea578ae5ce0e4 dovecot-pigeonhole-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 54019518340f8fa074ec413b14912078ecae0a7642d78834c474e91938e0ed83 dovecot-pigeonhole-debuginfo-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 76f6cdd92765a82dd6566d4e154b0c0deadddc82cf4f6deec2ac7336efd79156 Red Hat Enterprise Linux Server - AUS 8.4 SRPM dovecot-2.3.8-9.el8_4.2.src.rpm SHA-256: 102baceafa070b04508fdaf265cb134b1536a665ad74f98f89a8619283434da3 x86_64 dovecot-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 778f6d9b6846baae37b8b84eac5764f0177a7bef8c00e7891675397d9df812d6 dovecot-debuginfo-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 7272eb9dcf56fc9cdd2a8add8ef0f79cb6742576df535386501b0d39dbf753bc dovecot-debugsource-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 6395836b086ef2cf5b45bd3c40a506de3f53bfa6e627a6c472936c95d6819673 dovecot-mysql-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 925c802eebc7e3d76688c17414a37cfb34cc07ba34f66e04e4d9c54a7bf7fcbe dovecot-mysql-debuginfo-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 9aa62e02b6d039a23eca359004f048e92a207299deec3b60d6d1a88abbd0001d dovecot-pgsql-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: fc1c227069078f18345bf47a07c1bac78520978a6c52296f63c615be6d6039a4 dovecot-pgsql-debuginfo-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 55f021d056284c53d8590887fe7223c46f4559a32b0393d3d6bea578ae5ce0e4 dovecot-pigeonhole-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 54019518340f8fa074ec413b14912078ecae0a7642d78834c474e91938e0ed83 dovecot-pigeonhole-debuginfo-2.3.8-9.el8_4.2.x86_64.rpm SHA-256: 76f6cdd92765a82dd6566d4e154b0c0deadddc82cf4f6deec2ac7336efd79156 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .