CVE-2026-27860— CVE-2026-27860.md: v2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication.

Security ​Dovecot was designed since the beginning with security in mind and with many ways to provide privilege separation. Although the code is written with C, it’s a little bit special C variant that makes it much more difficult to write security holes accidentally than with most other C-based projects.Please see bugreport-mail for more information how to report bugs.Below is the list of all security holes found from Dovecot. Note that most of these are quite minor holes2026-03-27T00:00:00.000ZCVE-2026-27860.md: v2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication.2026-03-27T00:00:00.000ZCVE-2026-27859: v3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.2026-03-27T00:00:00.000ZCVE-2026-27858: managesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.2026-03-27T00:00:00.000ZCVE-2026-27857: imap-login: Excessive memory usage DoS. Sending `NOOP (((...)))` command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections.2026-03-27T00:00:00.000ZCVE-2026-27856: doveadm: Credentials verified without timing safety. Doveadm credentials are ve