Dovecot 2.4.4 Patches Five Vulnerabilities — Update Now
On 5 May 2026, the Dovecot team published security advisory OXDC-2026-0002, covering five vulnerabilities fixed in OX Dovecot CE 2.4.4 (and Pro 3.1.5). If you are running Dovecot CE 2.4.3 or earlier, this is your prompt to upgrade. What’s in the advisory CVE-2026-27851 — SQL/LDAP injection via variable expansion (CVSS 7.4) The most serious of the five. When the safe filter is used in Dovecot’s variable expansion (lib-var-expand), it incorrectly treats all subsequent pipelines on the same string as safe too. The result: attacker-controlled data can bypass escaping and land unmodified in SQL or LDAP queries used for authentication. No public exploit exists yet, but CVSS 7.4 with a network attack vector and no required privileges is not something to sit on. If you cannot upgrade immediately, the workaround is to avoid the safe filter in your configuration until you can. ...