Skip to content
Moderate DoS and Info Disclosure Vulnerabilities in Dovecot Affect Fedora 43 and 44

Moderate DoS and Info Disclosure Vulnerabilities in Dovecot Affect Fedora 43 and 44

First seen 2 Jun 2026, 06:22 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 3, 2026 at 05:45 UTC
  • •Dovecot in Fedora 43 and 44 has multiple vulnerabilities allowing DoS and info disclosure.
  • •Key CVEs include CVE-2026-33603 and CVE-2026-40020, published on May 12, 2026.
  • •Users are urged to apply updates to mitigate risks associated with these vulnerabilities.

Fedora versions 43 and 44 of Dovecot have been found to contain multiple vulnerabilities, including CVE-2026-33603, CVE-2026-40020, and CVE-2026-42006. These vulnerabilities allow for information disclosure and denial-of-service (DoS) attacks, affecting users who rely on IMAP services. Attackers could exploit these vulnerabilities through methods such as channel binding bypass and excessive bracing over IMAP, leading to potential service disruptions. The vulnerabilities were disclosed on May 12, 2026, and are linked to incomplete fixes from earlier patches. Users are advised to update their systems to mitigate these risks. The vulnerabilities are present in both Fedora 43 and 44, indicating a broader impact across these versions. The updates can be installed using the 'dnf' package manager.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 110d ago How this analysis works

Timeline

2026-03-27
Incomplete fix released for CVE-2026-27857
An incomplete fix for a previous vulnerability led to the current issues in Dovecot.
Linuxsecurity
2026-05-12
Multiple CVEs published for Dovecot vulnerabilities
CVE-2026-33603, CVE-2026-40020, and CVE-2026-42006 disclosed, affecting Fedora 43 and 44.
Linuxsecurity
2026-05-12
CVE-2026-33603 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-27851 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-40016 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-40020 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-42006 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-02
Current advisory issued for Fedora Dovecot vulnerabilities
Fedora 43 and 44 users are advised to update Dovecot to mitigate identified vulnerabilities.
Linuxsecurity

More articles in this cluster (3)

Following this threat?

Track Fedora and CVE-2026-27851 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 4