The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade dovecot | Mar 30, 2026 | Mar 27, 2026 |
| Amazon Linux Ami 2 | — | Upgrade dovecot-debuginfoUpgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-pgsqlUpgrade dovecot-pigeonholeUpgrade dovecot-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade dovecot-pgsqlUpgrade dovecot-develUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonholeUpgrade dovecot-debuginfoUpgrade dovecot-mysql-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecotUpgrade dovecot-debugsource | Apr 14, 2026 | Mar 27, 2026 |
| Debian | — | Upgrade dovecot | Apr 7, 2026 | Apr 7, 2026 |
| Oracle_linux | — | Upgrade dovecot-pigeonholeUpgrade dovecot-mysqlUpgrade dovecot-develUpgrade dovecotUpgrade dovecot-pgsql | Oct 22, 2026 | Mar 27, 2026 |
| Redhat_linux | — | No solution existsUpgrade dovecot-develUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot-debuginfoUpgrade dovecot | Jun 19, 2026 | Mar 27, 2026 |
| Ubuntu | — | Upgrade dovecot-core | Apr 1, 2026 | Mar 31, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub