CVE-2026-27851

EUVD-2026-29467
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.38%
Affected Products (NVD)
VendorProductVersion
dovecotdovecot
𝑥
< 2.4.4
open-xchangedovecot
𝑥
< 3.1.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
dovecot
bookworm
1:2.3.19.1+dfsg1-2.1+deb12u6
fixed
bookworm (security)
1:2.3.19.1+dfsg1-2.1+deb12u6
fixed
bullseye
1:2.3.13+dfsg1-2+deb11u1
fixed
bullseye (security)
1:2.3.13+dfsg1-2+deb11u4
fixed
forky
1:2.4.4+dfsg1-2
fixed
sid
1:2.4.4+dfsg1-2
fixed
trixie
1:2.4.1+dfsg1-6+deb13u6
fixed
trixie (security)
1:2.4.1+dfsg1-6+deb13u6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
dovecot
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
Fixed 1:2.4.1+dfsg1-5ubuntu4.2
released
resolute
Fixed 1:2.4.2+dfsg1-3ubuntu2.1
released
trusty
not-affected
xenial
not-affected