Back Linuxsecurity

Oracle Dovecot Important Authentication Fix Advisory ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • August 12, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

[1:2.2.36-8.0.3] - Backport fix for CVE-2026-42006 [Orabug: 39820967] [1:2.2.36-8.0.1] - Backport fix for CVE-2025-59032 [Orabug: 39573795] - Backport fix for CVE-2026-27856 [Orabug: 39573795] - Backport fix for CVE-2026-27857 [Orabug: 39573795] - Backport fix for CVE-2026-27858 [Orabug: 39573795]

dovecot-2.2.36-8.0.3.el7.i686.rpm dovecot-2.2.36-8.0.3.el7.x86_64.rpm dovecot-devel-2.2.36-8.0.3.el7.x86_64.rpm dovecot-mysql-2.2.36-8.0.3.el7.x86_64.rpm dovecot-pgsql-2.2.36-8.0.3.el7.x86_64.rpm dovecot-pigeonhole-2.2.36-8.0.3.el7.x86_64.rpm

Related CVEs: CVE-2026-42006

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Dovecot Security Fixes Address Multiple Vulnerabilities Oracle has released important security updates for Dovecot in Oracle Linux 7, addressing multiple vulnerabilities. The updates fix CVE-2020-12100, CVE-2020-12673, CVE-2020-12674, and several CVEs from 2026, including CVE-2025-59032, CVE-2026-27856, CVE-2026-27857, CVE-2026-27858, and CVE-2026-42006. These vulnerabilities could lead to resource exhaustion, out-of-bounds reads, and crashes, impacting systems using Dovecot for email services. The updates include backports of critical fixes, and users are advised to audit Linux privileges to mitigate potential risks. The vulnerabilities affect various Dovecot packages across both 32-bit and 64-bit architectures. Administrators are urged to apply the patches promptly to safeguard their systems. 2 sources 58

Extracted Entities

CVEs (5)

CVE-2025-59032 CVE-2026-27856 CVE-2026-27857 CVE-2026-27858 CVE-2026-42006

Platforms (2)

Dovecot Linux