The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade dovecot | Mar 30, 2026 | Mar 27, 2026 |
| Amazon Linux Ami 2 | — | Upgrade dovecot-debuginfoUpgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-develUpgrade dovecot-pigeonholeUpgrade dovecot-pgsql | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade dovecot-pgsqlUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonholeUpgrade dovecot-develUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-debuginfoUpgrade dovecot-mysql-debuginfoUpgrade dovecot-debugsource | Apr 14, 2026 | Mar 27, 2026 |
| Debian | — | Upgrade dovecot | Apr 7, 2026 | Apr 7, 2026 |
| Oracle_linux | — | Upgrade dovecot-pgsqlUpgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot-devel | Oct 22, 2026 | Mar 27, 2026 |
| Redhat_linux | — | Upgrade dovecot-pigeonholeUpgrade dovecotUpgrade dovecot-debuginfoUpgrade dovecot-pgsqlNo solution existsUpgrade dovecot-develUpgrade dovecot-mysql | Jun 19, 2026 | Mar 27, 2026 |
| Ubuntu | — | Upgrade dovecot-core | Apr 1, 2026 | Mar 31, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub