PatchTheCVEdovecot vulnerabilities and fixes
Recent CVEs affecting dovecot, with upgrade or downgrade steps. 2 tracked.
dovecot has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-03-27. Highest priority: CVE-2026-27859 (score 32/100).
- CVE-2026-27859 MEDIUM 5.3 UPGRADE UPGRADE A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU
- CVE-2026-27860 LOW 3.7 UPGRADE UPGRADE If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authenticati
FAQ
How do I fix dovecot vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dovecot being exploited right now?
None of the tracked dovecot CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dovecot CVE should I patch first?
CVE-2026-27859 currently ranks highest (32/100): A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.