[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7Uotj-RMjTzdsZ4PwEuB2A4PZwlZwZ4e15vM0HoK-FU":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":26,"kevVulnerabilities":87,"topProductsByCves":88,"seoMetadata":91,"meta":100},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":25},8438,"dovecot",2,53,0,266,"2022-07-17","d",[16,19],{"id":17,"product_name":8,"version_count":18,"cve_count":10,"kev_count":11,"last_cve_update":13},39114,209,{"id":20,"product_name":21,"version_count":22,"cve_count":23,"kev_count":11,"last_cve_update":24},39115,"pigeonhole",57,1,"2019-08-29","Dovecot is a technology vendor with 2 tracked products and 53 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[27,35,43,50,56,62,69,73,79,84],{"cveId":28,"description":29,"publishedDate":24,"cvssScore":30,"cvssVersion":31,"severity":32,"isKev":33,"epssScore":34},"CVE-2019-11500","In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.",9.8,"v3.0","Critical",false,0.62324,{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"cvssVersion":40,"severity":41,"isKev":33,"epssScore":42},"CVE-2020-7046","lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.","2020-02-12",7.5,"v3.1","High",0.51264,{"cveId":44,"description":45,"publishedDate":46,"cvssScore":47,"cvssVersion":31,"severity":48,"isKev":33,"epssScore":49},"CVE-2016-8652","The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.","2017-02-17",5.9,"Medium",0.48197,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":31,"severity":41,"isKev":33,"epssScore":55},"CVE-2017-14461","A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.","2018-03-02",7.1,0.16677,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":60,"cvssVersion":40,"severity":48,"isKev":33,"epssScore":61},"CVE-2020-10967","In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.","2020-05-18",5.3,0.08153,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":66,"cvssVersion":67,"severity":48,"isKev":33,"epssScore":68},"CVE-2008-1218","Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.","2008-03-10",6.8,"v2",0.07342,{"cveId":70,"description":71,"publishedDate":59,"cvssScore":39,"cvssVersion":40,"severity":41,"isKev":33,"epssScore":72},"CVE-2020-10957","In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.",0.07167,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":77,"cvssVersion":67,"severity":48,"isKev":33,"epssScore":78},"CVE-2008-4907","The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka \"invalid message address parsing bug.\"","2008-11-04",4.3,0.06203,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":39,"cvssVersion":40,"severity":41,"isKev":33,"epssScore":83},"CVE-2020-12674","In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.","2020-08-12",0.06187,{"cveId":85,"description":86,"publishedDate":82,"cvssScore":39,"cvssVersion":40,"severity":41,"isKev":33,"epssScore":83},"CVE-2020-12673","In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.",[],[89,90],{"id":17,"product_name":8,"version_count":18,"cve_count":10,"kev_count":11,"last_cve_update":13},{"id":20,"product_name":21,"version_count":22,"cve_count":23,"kev_count":11,"last_cve_update":24},{"title":92,"metaDescription":93,"keywords":94,"structuredData":95},"Dovecot - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Dovecot covering 2 products with 53 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Dovecot vulnerabilities, Dovecot security, Dovecot CVE, Dovecot threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":96,"@type":97,"name":98,"description":93,"url":99},"https:\u002F\u002Fschema.org","Organization","Dovecot","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fdovecot",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":101,"apiVersion":102},"2026-10-19T18:52:19.901Z","3.0"]