CVE-2026-27860

EUVD-2026-16573
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.
LDAP Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 6%
Affected Products (NVD)
VendorProductVersion
dovecotdovecot
𝑥
< 2.4.3
open-xchangedovecot
𝑥
< 3.1.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
dovecot
bookworm
1:2.3.19.1+dfsg1-2.1+deb12u1
fixed
bookworm (security)
1:2.3.19.1+dfsg1-2.1+deb12u4
fixed
bullseye
1:2.3.13+dfsg1-2+deb11u1
fixed
bullseye (security)
1:2.3.13+dfsg1-2+deb11u3
fixed
forky
1:2.4.3+dfsg1-2
fixed
sid
1:2.4.3+dfsg1-2
fixed
trixie
vulnerable
trixie (security)
1:2.4.1+dfsg1-6+deb13u4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
dovecot
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
Fixed 1:2.4.1+dfsg1-5ubuntu4.1
released
trusty
not-affected
xenial
not-affected
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json