Sql-Injection

Dovecot’s security page quietly listed a new high-severity advisory on August 28, 2026. The major Linux distributions took about six weeks to ship patched packages, and Red Hat’s advisory for RHEL 10 landed on October 8, 2026. If you run Dovecot against a MySQL or MariaDB backend and haven’t updated recently, read on. What the Bug Is CVE-2026-40018 is an SQL injection flaw (CWE-89) in Dovecot’s MySQL driver. The escaping function that sanitizes SQL query parameters falls back to a charset-unaware escape call when the SQL connection drops and reconnects under specific multi-byte character sequences. An attacker who can supply crafted input at the right moment — say, through a malformed username or password string — can break out of the expected SQL context and either read sensitive data or modify it. ...