The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 21, 2018 |
| Debian | — | Upgrade dovecot | Apr 12, 2017 | Apr 10, 2017 |
| Freebsd | — | Upgrade dovecot2Upgrade dovecot | May 2, 2017 | Apr 30, 2017 |
| Suse | — | Upgrade dovecot22-backend-pgsqlUpgrade dovecot22-develUpgrade dovecot22-backend-sqliteUpgrade dovecot22-backend-mysqlUpgrade dovecot22Upgrade dovecot | May 11, 2017 | Apr 10, 2017 |
| Ubuntu | — | Upgrade dovecot-core | Apr 11, 2017 | Apr 10, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub