Red Hat Product Errata RHSA-2026:26564 - Security Advisory
Issued:
2026-06-17
Updated:
2026-06-17

RHSA-2026:26564 - Security Advisory

Synopsis

Important: dovecot security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for dovecot is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

  • dovecot: Doveadm: Full access via timing oracle attack in credential verification (CVE-2026-27856)
  • dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)
  • dovecot: denial of service via crafted message before authentication (CVE-2026-27858)
  • dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

  • BZ - 2452171 - CVE-2026-27856 dovecot: Doveadm: Full access via timing oracle attack in credential verification
  • BZ - 2452172 - CVE-2025-59032 dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command
  • BZ - 2452175 - CVE-2026-27858 dovecot: denial of service via crafted message before authentication
  • BZ - 2452179 - CVE-2026-27857 dovecot: denial of service via specially crafted NOOP command

Red Hat Enterprise Linux Server - Extended Life Cycle Support 7

SRPM
dovecot-2.2.36-8.el7_9.1.src.rpm SHA-256: b931f43eb83ce1d44c6fd0a46bc7ba16aa20949a38da8ee6f5cd6a7cc09c1638
x86_64
dovecot-2.2.36-8.el7_9.1.i686.rpm SHA-256: c849345488119d45919b702e29725fba3eaf5564699dee12a5367a380120ba63
dovecot-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 707d9911a79208cfe856a60f4dc2b7e30767ae8e2662f19d02b395bb283c110d
dovecot-debuginfo-2.2.36-8.el7_9.1.i686.rpm SHA-256: 2f5237eece4cb6dd492bcf72842e129eb2af09a01da77fdc196bad6138e8f95d
dovecot-debuginfo-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 44ae7a097930d768130ef6b3df67e5d6ca01e396de7d7dfeea1d72dbf226bb9b
dovecot-debuginfo-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 44ae7a097930d768130ef6b3df67e5d6ca01e396de7d7dfeea1d72dbf226bb9b
dovecot-devel-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 3ea09d763e61dcdb5ffb04e23c4143c4f0088a0e61ca0149c9d5eccc83379c54
dovecot-mysql-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 54677ca1b7f5f5353ee567bc70f92cfbf3181aef8a1a56b20569313088c96580
dovecot-pgsql-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 9c01a5430546570eda1bf3f711ad47ad710271122f044ee4e1a47d7aecd5e4a6
dovecot-pigeonhole-2.2.36-8.el7_9.1.x86_64.rpm SHA-256: 41197bf5a1a8b4a1dc0142c378e871049c96db02a80e48ae13872055e6e4e82d

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7

SRPM
dovecot-2.2.36-8.el7_9.1.src.rpm SHA-256: b931f43eb83ce1d44c6fd0a46bc7ba16aa20949a38da8ee6f5cd6a7cc09c1638
s390x
dovecot-2.2.36-8.el7_9.1.s390.rpm SHA-256: a70d623d8896927896941a8254e0ecf372935fc5505bf92acdf4d571ce413303
dovecot-2.2.36-8.el7_9.1.s390x.rpm SHA-256: a27c00f5cf3650c5a3a8bec2ac8dfad0a39c5d494279a319bb41d1bad30b6486
dovecot-debuginfo-2.2.36-8.el7_9.1.s390.rpm SHA-256: 76b05de91ee77e70c0129c549364fdb38f39a2976b5b71291813d7850c57a8fc
dovecot-debuginfo-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 77dc263d048888724d74f183257b44615b73f72a4764573e5c60e261a2a5333f
dovecot-debuginfo-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 77dc263d048888724d74f183257b44615b73f72a4764573e5c60e261a2a5333f
dovecot-devel-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 5d3734d795cb23e8c0f42b8809a019511c7555180354748a3e141b7d683ecb05
dovecot-mysql-2.2.36-8.el7_9.1.s390x.rpm SHA-256: d70c69e9f0df59a070df1070f6a709f5e244b03286107fca8130881cb1368d2c
dovecot-pgsql-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 18297f82572106133b71337de95b714c31cee77b9fe22d945ce32012cbc66dcd
dovecot-pigeonhole-2.2.36-8.el7_9.1.s390x.rpm SHA-256: 7469acafa6d5a6b1055a627b7b00e4a3b407e42669031654422febe147a58c9f

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7

SRPM
dovecot-2.2.36-8.el7_9.1.src.rpm SHA-256: b931f43eb83ce1d44c6fd0a46bc7ba16aa20949a38da8ee6f5cd6a7cc09c1638
ppc64
dovecot-2.2.36-8.el7_9.1.ppc.rpm SHA-256: 55f82615d67850540de9d03c8e9167f6b20f1b5ce625be231cce5ac2116f175c
dovecot-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 9ec204c686d64f266c5b971ae573815410d0b8347ab9b466dcdfe5f3d233a6b7
dovecot-debuginfo-2.2.36-8.el7_9.1.ppc.rpm SHA-256: bcd9d4cfa2501c62864e207c5cf1189415dbe6ff9257ac23a2619665d8e6b243
dovecot-debuginfo-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 9926f686450633b220a543f3fe5edd547eb939cee467d309d2aee9cc3f190a0c
dovecot-debuginfo-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 9926f686450633b220a543f3fe5edd547eb939cee467d309d2aee9cc3f190a0c
dovecot-devel-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: d2835e5730afd0f8d0545bee4551f3bedcd7c68e6eccbf39e5d5736d822fceac
dovecot-mysql-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 53dab5501bf6e39f7cd18df4e7c01d90641c2706d15d1b7b39c8dd256ef64637
dovecot-pgsql-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 9a118e4fb6d0b6aa0959e579994d7d03e6a1649a67f33f77335493451a67ef2f
dovecot-pigeonhole-2.2.36-8.el7_9.1.ppc64.rpm SHA-256: 2231f0631cfae85cd4406228187bf85ffa79cce2606cbf2957c799d24f4b4d2b

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7

SRPM
dovecot-2.2.36-8.el7_9.1.src.rpm SHA-256: b931f43eb83ce1d44c6fd0a46bc7ba16aa20949a38da8ee6f5cd6a7cc09c1638
ppc64le
dovecot-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 02266ebd7b56e08a05aac3a984e450502636e671de3ce482e41d78d590898f36
dovecot-debuginfo-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 90d3b6d5bc1ebc47c2d846422574d05c38fa9ac4b27693186d7ff76d99a52999
dovecot-debuginfo-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 90d3b6d5bc1ebc47c2d846422574d05c38fa9ac4b27693186d7ff76d99a52999
dovecot-devel-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 078a5104a25fdb4be4e797c7e323e0edc9737d2fb93dd39aab189410d79a4320
dovecot-mysql-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 498242138daddaa4bb6225862db573f5992c30abcd88a5c25815ba74d65e87b2
dovecot-pgsql-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: a193389cc4103af40ef88f775678d86de5f64dfb283fea94c1963a1890bde8c3
dovecot-pigeonhole-2.2.36-8.el7_9.1.ppc64le.rpm SHA-256: 8df9dd7a79c8c17f24b95850c5c1b208c4c44250531e1d3ba6977a17311bc36e

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.