PT-2026-28364 · Doveadm+3 · Doveadm+3

Published 2026-01-01 · Updated 2026-04-16 · CVE-2026-27856

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Doveadm (affected versions not specified)

Description Doveadm credentials are verified using direct comparison, which is susceptible to a timing oracle attack. An attacker could potentially determine the configured credentials, leading to full access to the affected component.

Recommendations Limit access to the doveadm http service port. Install the fixed version dovecot24-2.4.3-1.1.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-27856

OESA-2026-1849

OPENSUSE-SU-2026:10442-1

OPENSUSE-SU-2026:20554-1

SUSE-SU-2026:21208-1

USN-8136-1

Affected Products

Doveadm

Dovecot

Linuxmint

Ubuntu

References · 55

• https://osv.dev/vulnerability/openSUSE-SU-2026:10442-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27859 · Security Note
• https://ubuntu.com/security/CVE-2025-59028 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0394 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:21208-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-27856 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59031 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27856 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1849 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27859 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27856 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27858 · Security Note