CLSA-2026-1792570553
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792570553.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792570553
- Upstream
CVE (7)
- CVE-2026-27852
- CVE-2026-33263
- CVE-2026-33605
- CVE-2026-40018
- CVE-2026-42007
- CVE-2026-42391
- CVE-2026-73208
- Published
- 2026-10-21T08:16:09Z
- Modified
- 2026-10-26T09:31:00Z
- Summary
- dovecot: Fix of 7 CVEs
- Details
-
- CVE-2026-27852: bound the transient RFC 2231 parameter list and the MIME parameter budget so a single oversized Content-Type header cannot exhaust imap memory
- CVE-2026-33263: track SMTP server connection closure so submission-login does not keep using a closed connection
- CVE-2026-33605: fix ManageSieve parser handling of a single-byte quoted string read in managesieve-login
- CVE-2026-40018: connect before expanding the passdb-sql password query and refuse to escape in the MySQL driver without a connection instead of escaping with the default charset
- CVE-2026-42007: fix Sieve editheader edit-mail handling of deleted and NUL-containing header values
- CVE-2026-42391: account external key/value pairs in the IMAP login ID command so a client cannot send an unbounded number of them
- CVE-2026-73208: validate the OAuth2 token audience and stop falling back to the aud claim when audience is configured
- References
-
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792570553.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-27852
- https://nvd.nist.gov/vuln/detail/CVE-2026-33263
- https://nvd.nist.gov/vuln/detail/CVE-2026-33605
- https://nvd.nist.gov/vuln/detail/CVE-2026-40018
- https://nvd.nist.gov/vuln/detail/CVE-2026-42007
- https://nvd.nist.gov/vuln/detail/CVE-2026-42391
- https://nvd.nist.gov/vuln/detail/CVE-2026-73208