Dovecot vulnerabilitiesNone on the known-exploited list.
Dovecot has 53 published vulnerabilities across 2 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Dovecot, with 53. If you run Dovecot software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Dovecot products have the most vulnerabilities?
Dovecot leads with 53 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Dovecot vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Dovecot's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Dovecot flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 62%CVE-2019-11500Critical
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings.
- 51%CVE-2020-7046High
lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.
- 48%CVE-2016-8652Medium
The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.
- 17%CVE-2017-14461High
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service.
- 8.2%CVE-2020-10967Medium
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.
- 7.3%CVE-2008-1218Medium
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters,...
- 7.2%CVE-2020-10957High
In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.
- 6.2%CVE-2008-4907Medium
The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed...
- 6.2%CVE-2020-12674High
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.
- 6.2%CVE-2020-12673High
In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.
All Dovecot products we track.
2 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
Running Dovecot? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
- Matched to
- Dovecot on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 53 published vulnerabilities across 2 products and 266 versions from Dovecot.
None of Dovecot's vulnerabilities is on the list of flaws known to be exploited today.
Dovecot, with 53 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Dovecot products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.