PT-2025-54917 · Dovecot+2 · Dovecot+2

Published 2025-01-01 · Updated 2026-04-30 · CVE-2025-59028

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.3

Description Sending invalid base64 SASL data can disrupt the login process by disconnecting it from the authentication server, leading to the failure of all active authentication sessions. This can be used to cause a denial-of-service condition, breaking concurrent logins.

Recommendations Install version 2.4.3 or disable concurrency in login processes.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-59028

OPENSUSE-SU-2026:10442-1

OPENSUSE-SU-2026:20554-1

SUSE-SU-2026:21208-1

USN-8136-1

Affected Products

Dovecot

Linuxmint

Ubuntu

References · 47

• https://ubuntu.com/security/CVE-2026-27855 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27857 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27858 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27860 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59032 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59028 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2025-59028 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-59028 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59028 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59028 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24031 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0394 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20554-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8136-1 · Vendor Advisory
• https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json · Vendor Advisory