SB20260505120 - Red Hat Enterprise Linux 9 update for dovecot
Published: May 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2025-59032)
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in Pigeonhole ManageSieve service when processing SASL AUTHENTICATE command. A remote attacker can send a specially crafted request using literal as SASL initial response to cause a denial of service.
The ManageSieve service crashes and becomes unavailable for other users.
2) Resource exhaustion (CVE-ID: CVE-2026-27858)
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in managesieve-login service when processing pre-authentication data. A remote attacker can send a specially crafted message before authentication to cause a denial of service.
3) Resource exhaustion (CVE-ID: CVE-2026-27857)
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in imap-login process when handling malformed NOOP commands. A remote user can send a specially crafted command with excessive parentheses to cause a denial of service.
Remediation
Install update from vendor's website.