CVE-2026-27860
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing...
Original description
The description as published by the source.
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2026-27860 dovecot Fixed in: 2.4.3-r0
- Debian DEBIAN-CVE-2026-27860 dovecot Fixed in: 1:2.4.1+dfsg1-6+deb13u4
References
- advisory documentation.open-xchange.com
- advisory github.com
- advisory nvd.nist.gov