Dovecot on Debian: DSA-6526-1 and DLA-4873-1 fix 25 flaws, including Sieve editheader RCE

Open-Xchange, the company behind Dovecot, published advisory OXDC-ADV-2026-0003 in August 2026 with an overall severity of Critical. Debian shipped the fixes for Debian 13 (trixie) on 28 September 2026 in DSA-6526-1 (25 CVEs), and the LTS team released the Debian 12 (bookworm) update on 31 October 2026 as DLA-4873-1 (24 CVEs). Debian lists possible denial of service, SMTP smuggling, information disclosure, SQL injection, remote code execution, ACL bypass and account impersonation.

At a glance

What the vulnerabilities are

Code execution through Sieve

CVE-2026-42007 (CVSS 9.1): a user with valid credentials can upload a Sieve script that uses the editheader extension to trigger a use-after-free during mail delivery. Open-Xchange says this can crash the delivery process and may allow arbitrary code execution in its context; its workaround is to disable editheader. A related ManageSieve bug, CVE-2026-40013, lets an authenticated user cause an out-of-bounds write with a huge number in a script.

Authentication and access control

• CVE-2026-40018 (7.4): SQL injection through multi-byte escaping, reachable without logging in, in MySQL-backed authentication.
• CVE-2026-73208 (7.4) and CVE-2026-40205 (5.9): OAuth2 tokens can be accepted with the wrong or only partial scopes.
• CVE-2026-42008: any host listed as a trusted proxy can authenticate as any user when the password database honours a no-password field. Deployments with no trusted proxies are not affected.
• CVE-2026-40204: an ACL bypass through mailbox auto-creation.

Denial of service before login

CVE-2026-42391 (an IMAP ID command with very many parameters), CVE-2026-33605 (a small malformed ManageSieve command) and CVE-2026-27852 (an incoming message with enormous headers) are each rated 7.5. The last one only needs the attacker to be able to send mail to a user.

Smuggling and information leaks

CVE-2026-33604: when Dovecot relays a message (Sieve redirect, submission relay), a crafted line ending can slip past its SMTP smuggling protection, so a downstream server that is not fixed may see injected commands. CVE-2026-40203: with IMAP compression, response sizes can reveal whether a small message body matches a guess. The remaining issues are mostly authenticated resource-exhaustion bugs. Debian's tracker marks CVE-2026-42392 (a memory leak in URLFETCH error messages) as not affecting bookworm, because that code arrived in Dovecot 2.4.

Open-Xchange says no public exploits are known, and none of these CVEs is in the CISA Known Exploited Vulnerabilities catalog (30 October 2026 edition).

Are you affected?

dpkg-query -W -f='${Package} ${Version}\n' 'dovecot-*'
apt policy dovecot-core
sudo doveconf -n | grep -nE 'editheader|trusted_networks|oauth2|mysql|compress'

Anything older than 1:2.4.1+dfsg1-6+deb13u7 on trixie or 1:2.3.19.1+dfsg1-2.1+deb12u7 on bookworm is affected.

How to update

sudo apt update
sudo apt install --only-upgrade dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-sieve dovecot-managesieved dovecot-submissiond dovecot-mysql dovecot-pgsql dovecot-sqlite dovecot-ldap
apt policy dovecot-core

Two side effects from the bookworm announcement are worth knowing. The fix for CVE-2026-40017 upgrades the THREAD index strmap files to a new on-disk format that older or unfixed Dovecot versions cannot read, so roll back with care and update servers that share mail storage together. IMAP COMPRESS is now limited to DEFLATE, and compressed sessions may be slightly less efficient.

Restart or reboot?

No reboot. Restart Dovecot so all login and mail processes use the new code:

sudo systemctl restart dovecot
dovecot --version
sudo systemctl status dovecot --no-pager

Sources

• security-tracker.debian.org/tracker/DSA-6526-1
• debian.org/security/2026/dsa-6526
• lists.debian.org/debian-security-announce/2026/msg00439.html
• security-tracker.debian.org/tracker/DLA-4873-1
• lists.debian.org/debian-lts-announce/2026/10/msg00066.html
• security-tracker.debian.org/tracker/CVE-2026-42007
• security-tracker.debian.org/tracker/CVE-2026-42392
• documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003...
• documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003...
• cve.org/CVERecord?id=CVE-2026-42007
• cve.org/CVERecord?id=CVE-2026-42008
• cve.org/CVERecord?id=CVE-2026-33604
• cisa.gov/known-exploited-vulnerabilities-catalog
• packages.debian.org/source/trixie/dovecot
• packages.debian.org/source/bookworm/dovecot