Back Linuxsecurity

Oracle Linux 7 Dovecot Important Security Fix ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • August 12, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

[1:2.2.36-8] - update release number [1:2.2.36-7.1] - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866752) - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866757) - fix CVE-2020-12674 crash due to assert in RPA implementation (#1866764) [1:2.2.36-7] - generated key was too small (#1086365)

dovecot-2.2.36-8.el7.i686.rpm dovecot-2.2.36-8.el7.x86_64.rpm dovecot-devel-2.2.36-8.el7.x86_64.rpm dovecot-mysql-2.2.36-8.el7.x86_64.rpm dovecot-pgsql-2.2.36-8.el7.x86_64.rpm dovecot-pigeonhole-2.2.36-8.el7.x86_64.rpm

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Dovecot Security Fixes Address Multiple Vulnerabilities Oracle has released important security updates for Dovecot in Oracle Linux 7, addressing multiple vulnerabilities. The updates fix CVE-2020-12100, CVE-2020-12673, CVE-2020-12674, and several CVEs from 2026, including CVE-2025-59032, CVE-2026-27856, CVE-2026-27857, CVE-2026-27858, and CVE-2026-42006. These vulnerabilities could lead to resource exhaustion, out-of-bounds reads, and crashes, impacting systems using Dovecot for email services. The updates include backports of critical fixes, and users are advised to audit Linux privileges to mitigate potential risks. The vulnerabilities affect various Dovecot packages across both 32-bit and 64-bit architectures. Administrators are urged to apply the patches promptly to safeguard their systems. 2 sources 58

Extracted Entities

Oracle Linux 7 Dovecot Important Security Fix ELSA-2026

The full story

Extracted Entities

CVEs (7)

CWE Weaknesses (1)

Platforms (1)