Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-3935
Advisory Released Date: 2026-09-28
Advisory Updated Date: 2026-09-28
FAQs regarding Amazon Linux ALAS/CVE Severity
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known. (CVE-2026-27852)
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known. (CVE-2026-42007)
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known. (CVE-2026-42008)
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known. (CVE-2026-42391)
Affected Packages:
dovecot
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update dovecot or yum update --advisory ALAS2-2026-3935 to update your system.
aarch64:
dovecot-2.2.36-6.amzn2.1.4.aarch64
dovecot-pigeonhole-2.2.36-6.amzn2.1.4.aarch64
dovecot-pgsql-2.2.36-6.amzn2.1.4.aarch64
dovecot-mysql-2.2.36-6.amzn2.1.4.aarch64
dovecot-devel-2.2.36-6.amzn2.1.4.aarch64
dovecot-debuginfo-2.2.36-6.amzn2.1.4.aarch64
i686:
dovecot-2.2.36-6.amzn2.1.4.i686
dovecot-pigeonhole-2.2.36-6.amzn2.1.4.i686
dovecot-pgsql-2.2.36-6.amzn2.1.4.i686
dovecot-mysql-2.2.36-6.amzn2.1.4.i686
dovecot-devel-2.2.36-6.amzn2.1.4.i686
dovecot-debuginfo-2.2.36-6.amzn2.1.4.i686
src:
dovecot-2.2.36-6.amzn2.1.4.src
x86_64:
dovecot-2.2.36-6.amzn2.1.4.x86_64
dovecot-pigeonhole-2.2.36-6.amzn2.1.4.x86_64
dovecot-pgsql-2.2.36-6.amzn2.1.4.x86_64
dovecot-mysql-2.2.36-6.amzn2.1.4.x86_64
dovecot-devel-2.2.36-6.amzn2.1.4.x86_64
dovecot-debuginfo-2.2.36-6.amzn2.1.4.x86_64