SUSE-SU-2026:1641-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20261641-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1641-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:1641-1
Upstream
CVE (7)
Related
CVE (7)
Published
2026-04-28T11:53:47Z
Modified
2026-04-29T08:00:56Z
Summary
Security update for dovecot22
Details

This update for dovecot22 fixes the following issues:

  • CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing (bsc#1260895).
  • CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).
  • CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).
  • CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).
  • CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).
  • CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).
  • CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).
References

Affected packages