AZL-98328

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-98328.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-98328

Upstream

CVE-2026-40015

Published

2026-08-28T12:16:28Z

Modified

2026-09-03T05:28:38Z

Summary

CVE-2026-40015 affecting package dovecot 2.3.20-1

Details

An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. Disable IMAP hibernation. Update to non-vulnerable version. No publicly available exploits are known.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-40015

Affected packages

Azure Linux:3 / dovecot

Package

Name: dovecot
Purl: pkg:rpm/azure-linux/dovecot

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.3.20-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-98328.json"