Amazon Linux 2023 Security Advisory: ALAS2023-2026-3109
Advisory Released Date: 2026-09-29
Advisory Updated Date: 2026-09-29
FAQs regarding Amazon Linux ALAS/CVE Severity
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known. (CVE-2026-27852)
MySQL multi-byte escaping wrong (CVE-2026-40018)
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known. (CVE-2026-42007)
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known. (CVE-2026-42008)
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known. (CVE-2026-42391)
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known. (CVE-2026-73208)
Affected Packages:
dovecot
Issue Correction:
Run dnf update dovecot --releasever 2023.12.20260928 or dnf update --advisory ALAS2023-2026-3109 --releasever 2023.12.20260928 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
dovecot-pgsql-debuginfo-2.3.20-1.amzn2023.0.4.aarch64
dovecot-pigeonhole-debuginfo-2.3.20-1.amzn2023.0.4.aarch64
dovecot-mysql-2.3.20-1.amzn2023.0.4.aarch64
dovecot-mysql-debuginfo-2.3.20-1.amzn2023.0.4.aarch64
dovecot-pgsql-2.3.20-1.amzn2023.0.4.aarch64
dovecot-pigeonhole-2.3.20-1.amzn2023.0.4.aarch64
dovecot-devel-2.3.20-1.amzn2023.0.4.aarch64
dovecot-debuginfo-2.3.20-1.amzn2023.0.4.aarch64
dovecot-2.3.20-1.amzn2023.0.4.aarch64
dovecot-debugsource-2.3.20-1.amzn2023.0.4.aarch64
src:
dovecot-2.3.20-1.amzn2023.0.4.src
x86_64:
dovecot-mysql-debuginfo-2.3.20-1.amzn2023.0.4.x86_64
dovecot-pgsql-2.3.20-1.amzn2023.0.4.x86_64
dovecot-pgsql-debuginfo-2.3.20-1.amzn2023.0.4.x86_64
dovecot-mysql-2.3.20-1.amzn2023.0.4.x86_64
dovecot-pigeonhole-debuginfo-2.3.20-1.amzn2023.0.4.x86_64
dovecot-pigeonhole-2.3.20-1.amzn2023.0.4.x86_64
dovecot-devel-2.3.20-1.amzn2023.0.4.x86_64
dovecot-debuginfo-2.3.20-1.amzn2023.0.4.x86_64
dovecot-2.3.20-1.amzn2023.0.4.x86_64
dovecot-debugsource-2.3.20-1.amzn2023.0.4.x86_64