{"id":"openSUSE-SU-2026:20554-1","summary":"Security update for dovecot24","details":"This update for dovecot24 fixes the following issues:\n\n- Update to v2.4.3\n- CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).\n- CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing\n  (bsc#1260895).\n- CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).\n- CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen.\n  v2.4 regression (bsc#1260896).\n- CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).\n- CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).\n- CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).\n- CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).\n- CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).\n- CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always\n  happen. v2.4 regression (bsc#1260893).\n","modified":"2026-04-22T20:09:55.533789Z","published":"2026-04-16T13:10:27Z","related":["CVE-2025-59028","CVE-2025-59031","CVE-2025-59032","CVE-2026-24031","CVE-2026-27855","CVE-2026-27856","CVE-2026-27857","CVE-2026-27858","CVE-2026-27859","CVE-2026-27860"],"upstream":["CVE-2025-59028","CVE-2025-59031","CVE-2025-59032","CVE-2026-24031","CVE-2026-27855","CVE-2026-27856","CVE-2026-27857","CVE-2026-27858","CVE-2026-27859","CVE-2026-27860"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260893"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260894"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260895"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260896"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260897"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260898"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260899"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260900"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260901"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260902"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-59028"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-59031"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-59032"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-24031"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27855"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27856"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27857"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27858"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27859"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27860"}],"affected":[{"package":{"name":"dovecot24","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/dovecot24&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"dovecot24-backend-pgsql":"2.4.3-160000.1.1","dovecot24-backend-sqlite":"2.4.3-160000.1.1","dovecot24-devel":"2.4.3-160000.1.1","dovecot24-fts-flatcurve":"2.4.3-160000.1.1","dovecot24-fts-solr":"2.4.3-160000.1.1","dovecot24-fts":"2.4.3-160000.1.1","dovecot24":"2.4.3-160000.1.1","dovecot24-backend-mysql":"2.4.3-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20554-1.json"}}],"schema_version":"1.7.5"}