Dovecot on Debian: DSA-6197-1 security fixes and the two bookworm regression updates (DSA-6197-2, -3)

On 5 April 2026 Debian released DSA-6197-1 for Dovecot on Debian 12 (bookworm) and Debian 13 (trixie). It carried the fixes from Open-Xchange advisory OXDC-ADV-2026-0001, which the vendor rated High overall. Debian described the impact as possible denial of service, SQL injection, path traversal, replay attacks or timing side-channel attacks.

The bookworm version needed two follow-up regression updates: DSA-6197-2 the next day, and DSA-6197-3 on 1 May. This note covers what was fixed, what broke, and how to confirm a server is in a good state.

At a glance

What the vulnerabilities are

Authentication weaknesses

• CVE-2026-24031 (CVSS 7.7, Dovecot 2.4 only, so trixie): SQL-based authentication can be bypassed for any user if an administrator has cleared auth_username_chars. Open-Xchange's advice is not to clear that setting. CVE-2026-27860 is the LDAP counterpart (filter injection), also 2.4-only.
• CVE-2026-27856 (7.4): doveadm credentials were compared in a way that leaks timing, which could let an attacker work out the configured secret and gain full access to that interface. Open-Xchange advises limiting access to the doveadm HTTP port.
• CVE-2026-27855 (6.8): the OTP mechanism could be replayed in certain setups with the authentication cache enabled.
• CVE-2026-0394 (5.3): with per-domain passwd-file databases, a path traversal could make Dovecot read /etc/passwd instead.

Denial of service

• CVE-2025-59032 (7.5): the ManageSieve AUTHENTICATE command crashed the service when given a literal as the initial SASL response.
• CVE-2026-27858 (7.5) and CVE-2026-27857 (4.3): crafted input before login could make the managesieve-login and imap-login processes use excessive memory.
• CVE-2026-27859 (5.3): messages with excessive RFC 2231 MIME parameters caused high CPU use.

CVE-2025-59031 concerned the example decode2text.sh script for attachment indexing, which could follow symlinks. None of these CVEs is in the CISA Known Exploited Vulnerabilities catalog (30 October 2026 edition).

The bookworm regressions

• DSA-6197-2 (6 April): the bookworm backport of the CVE-2025-59032 fix broke authentication against managesieved. Users who manage mail filters over ManageSieve could not log in until ...deb12u3.
• DSA-6197-3 (1 May): the bookworm backport of the CVE-2026-0394 fix broke path normalisation in passwd-file lookups, fixed in ...deb12u4.

Both were in the security fixes themselves, so the answer is to move forward, not to roll back.

Are you affected?

dpkg-query -W -f='${Package} ${Version}\n' 'dovecot-*'
apt policy dovecot-core
sudo doveconf -n | grep -nE 'passwd-file|auth_username_chars|doveadm|otp|managesieve'

Dovecot has had more fixes since April (DSA-6313-1 in May; DSA-6526-1 for trixie in September and DLA-4873-1 for bookworm on 31 October). Today's targets are 1:2.4.1+dfsg1-6+deb13u7 on trixie and 1:2.3.19.1+dfsg1-2.1+deb12u7 on bookworm; anything older is missing fixes.

How to update

sudo apt update
sudo apt install --only-upgrade dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-sieve dovecot-managesieved dovecot-mysql dovecot-pgsql dovecot-sqlite dovecot-ldap
apt policy dovecot-core

Restart or reboot?

No reboot. Restart Dovecot, then test the login paths that the regressions touched:

sudo systemctl restart dovecot
sudo doveadm auth test user@example.com
sudo systemctl status dovecot --no-pager

Replace the address with a real account; doveadm auth test prompts for the password. If you use ManageSieve, also save a filter from your client to confirm port 4190 logins work.

Sources

• security-tracker.debian.org/tracker/DSA-6197-1
• debian.org/security/2026/dsa-6197
• lists.debian.org/debian-security-announce/2026/msg00106.html
• security-tracker.debian.org/tracker/DSA-6197-2
• lists.debian.org/debian-security-announce/2026/msg00110.html
• security-tracker.debian.org/tracker/DSA-6197-3
• lists.debian.org/debian-security-announce/2026/msg00150.html
• security-tracker.debian.org/tracker/DLA-4556-1
• lists.debian.org/debian-lts-announce/2026/05/msg00000.html
• security-tracker.debian.org/tracker/CVE-2026-24031
• security-tracker.debian.org/tracker/CVE-2026-0394
• documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001...
• documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001...
• cve.org/CVERecord?id=CVE-2026-24031
• cve.org/CVERecord?id=CVE-2026-27856
• cisa.gov/known-exploited-vulnerabilities-catalog
• security-tracker.debian.org/tracker/DSA-6313-1
• security-tracker.debian.org/tracker/DLA-4873-1
• manpages.debian.org/trixie/dovecot-core/doveadm-auth.1.en.html