A Denial of Service vulnerability (CVE-2026-42006, CVSS 4.3) in Dovecot allows an attacker to crash the service via excessive IMAP bracing. The vulnerability affects Dovecot versions prior to 2.4.4 and Open-Xchange Dovecot versions prior to 3.1.5. The fix requires upgrading to Dovecot 2.4.4 or Open-Xchange Dovecot 3.1.5, respectively.
Red Hat Product Errata RHSA-2026:49513 - Security Advisory Issued: 2026-08-03 Updated: 2026-08-03 RHSA-2026:49513 - Security Advisory Overview Updated Packages Synopsis Important: dovecot security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for dovecot is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le Fixes BZ - 2476476 - CVE-2026-42006 dovecot: Dovecot: Denial of Service via excessive IMAP bracing CVEs CVE-2026-42006 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 SRPM dovecot-2.2.36-8.el7_9.2.src.rpm SHA-256: 15573b4a8ca27f205efaf9e4c0ed256327202e6eee11a408bfd6d974c6ef81e0 x86_64 dovecot-2.2.36-8.el7_9.2.i686.rpm SHA-256: 134e0435d376bc310996dc1b365f9318abc2157f56e8c419dd7ffc98e1e6181e dovecot-2.2.36-8.el7_9.2.x86_64.rpm SHA-256: 340eacc6e060632442300020803bc0d393daa25e44a0a4c67988001ae7069c86 dovecot-debuginfo-2.2.36-8.el7_9.2.i686.rpm SHA-256: cff6503492653ffee8edb5f44bda9cda4133bef8dbc3efb58147ec5b33a28be9 dovecot-debuginfo-2.2.36-8.el7_9.2.x86_64.rpm SHA-256: 7d4dc0acaa553cf677881bb905625c1f91d1eff2af1da5584b3e6a352393dcbe dovecot-debuginfo-2.2.36-8.el7_9.2.x86_64.rpm SHA-256: 7d4dc0acaa553cf677881bb905625c1f91d1eff2af1da5584b3e6a352393dcbe dovecot-devel-2.2.36-8.el7_9.2.x86_64.rpm SHA-256: 14473b3d7ccbbf8fcb3b47e22af2d04201d96db3af04a8913e2f6e353d45469d dovecot-mysql-2.2.36-8.el7_9.2.x86_64.rpm SHA-256: d8ffee2b054e1d61bccbc3e024e25597bbe07ccb2d5c7651b5eb909454107778 dovecot-pgsql-2.2.36-8.el7_9.2.x86_64.rpm SHA-256: 6018be10edd29d0338c1af8ac2f18344cdcb4cf1c1b8a848c9582476cfc03ec4 dovecot-pigeonhole-2.2.36-8.el7_9.2.x86_64.rpm SHA-256: a141b92619e1301bb16b42baf4a78f9f64c0d3405b6fd7c7075c96c75f0ce012 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 SRPM dovecot-2.2.36-8.el7_9.2.src.rpm SHA-256: 15573b4a8ca27f205efaf9e4c0ed256327202e6eee11a408bfd6d974c6ef81e0 s390x dovecot-2.2.36-8.el7_9.2.s390.rpm SHA-256: 6de3f82efba244047bb5de7e060d30101e20b0d8484c6bfdcee36c8093801b51 dovecot-2.2.36-8.el7_9.2.s390x.rpm SHA-256: 1bb98474d212b7db6d393df201f5f60506f541a188a275a0cedb0da9590b39ea dovecot-debuginfo-2.2.36-8.el7_9.2.s390.rpm SHA-256: 45deac84c730419d312320168cdb094b1cddb502c1436db27443eb63d2f70fe8 dovecot-debuginfo-2.2.36-8.el7_9.2.s390x.rpm SHA-256: fc669f4ec2f67d6132464938e96988c6519a7759bbd0285f98b82b31335b9685 dovecot-debuginfo-2.2.36-8.el7_9.2.s390x.rpm SHA-256: fc669f4ec2f67d6132464938e96988c6519a7759bbd0285f98b82b31335b9685 dovecot-devel-2.2.36-8.el7_9.2.s390x.rpm SHA-256: dcc26a90be13aeaf06916f7066ee1b6be3528c05a7ffaca372bdc0e9253ca971 dovecot-mysql-2.2.36-8.el7_9.2.s390x.rpm SHA-256: 268f7bcf074bdb9742752d8f4c8b0b6403dac2acd08fe80524fc9d7e2ea98c91 dovecot-pgsql-2.2.36-8.el7_9.2.s390x.rpm SHA-256: 9e88637057fa380d479b71f6c99db7dc0f84e97ca0785ee0c9f1714165e7a100 dovecot-pigeonhole-2.2.36-8.el7_9.2.s390x.rpm SHA-256: 75411d0a6658e7a93d5125d000ae73d5c16a82f52e909f247e949e891c693c35 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 SRPM dovecot-2.2.36-8.el7_9.2.src.rpm SHA-256: 15573b4a8ca27f205efaf9e4c0ed256327202e6eee11a408bfd6d974c6ef81e0 ppc64 dovecot-2.2.36-8.el7_9.2.ppc.rpm SHA-256: 433f4fb44cc013f9d4e26bff015a1db226606beb7fd25b4a0f88b0bf8ec08360 dovecot-2.2.36-8.el7_9.2.ppc64.rpm SHA-256: 6c8eb41e03f75233a64dc5d35f9c8dece665d29d11e08d343e29ecfee302f0f7 dovecot-debuginfo-2.2.36-8.el7_9.2.ppc.rpm SHA-256: 6343fbf73f12d7a2c15212614ecf06abfe97cac53fd56d25be19b2163f36e13d dovecot-debuginfo-2.2.36-8.el7_9.2.ppc64.rpm SHA-256: 01b3b55acb403ecae9d603396dbc97d7c7bc03e75aa833d489f618fbbfbed337 dovecot-debuginfo-2.2.36-8.el7_9.2.ppc64.rpm SHA-256: 01b3b55acb403ecae9d603396dbc97d7c7bc03e75aa833d489f618fbbfbed337 dovecot-devel-2.2.36-8.el7_9.2.ppc64.rpm SHA-256: 2f837e70738793e70947b090d30cfc275ae710cd840b6dbd73d9111e87cdfc8b dovecot-mysql-2.2.36-8.el7_9.2.ppc64.rpm SHA-256: e8f8d56ff7d3e6d932d601d4d98386d1829107cecb7b2c770ca3e7331456445a dovecot-pgsql-2.2.36-8.el7_9.2.ppc64.rpm SHA-256: db6d910580392803dfc5c8709afefc238d3ea84b1514d73a898db70dc0d6f44e dovecot-pigeonhole-2.2.36-8.el7_9.2.ppc64.rpm SHA-256: e79d59165f64a588a4d60a043207b17800c48d966d3653663bf4df27c5d3fb6e Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 SRPM dovecot-2.2.36-8.el7_9.2.src.rpm SHA-256: 15573b4a8ca27f205efaf9e4c0ed256327202e6eee11a408bfd6d974c6ef81e0 ppc64le dovecot-2.2.36-8.el7_9.2.ppc64le.rpm SHA-256: 28dcfcd6de9e041ad9a73c19d769c7503191def2c7e4c892e0a78bcbf32a686f dovecot-debuginfo-2.2.36-8.el7_9.2.ppc64le.rpm SHA-256: fec614e68b2b7f4e2f2eae9a6502f4903362175aa39c8512387215acc2619867 dovecot-debuginfo-2.2.36-8.el7_9.2.ppc64le.rpm SHA-256: fec614e68b2b7f4e2f2eae9a6502f4903362175aa39c8512387215acc2619867 dovecot-devel-2.2.36-8.el7_9.2.ppc64le.rpm SHA-256: 6effc09ea730cfcc212bdda3bf8495c8eea272909ac67fbab30475b4c97ec56a dovecot-mysql-2.2.36-8.el7_9.2.ppc64le.rpm SHA-256: c3c8c02cfb5eb65db65ea1ac9efcb3b3eb56cad725c40c23981cfddeb3364954 dovecot-pgsql-2.2.36-8.el7_9.2.ppc64le.rpm SHA-256: 9f79b10c78687f59b337e3a7f0819060776a598cbdb7d4dcd486e990fc6f244d dovecot-pigeonhole-2.2.36-8.el7_9.2.ppc64le.rpm SHA-256: 3faef2d1f2aa5dd3aefb0e735e37ea86192e1c68c98d1f64b8a32ff288474c12 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .