LoginSign Up
← Back to all sparks
D

Dovecot

COMMS
Velocity0.0

Open-source IMAP and POP3 mail server

www.dovecot.org ↗

Dovecot's 2.4 rewrite is still being paid for — twelve CVEs across two releases, two of them 2.4 regressions.

mail serverimapcve cadenceconfig rewriteprivilege separation
◆Current state
Dovecot 2.4 broke configuration compatibility outright in January 2025 and the line has been stabilizing ever since. The last two releases are dominated by security work: 2.4.3 shipped eight CVEs including SQL and LDAP injection when auth_username_chars is empty — both labelled v2.4 regressions — and 2.4.4 added four more, among them a fakeable CRAM channel binding and an incomplete earlier fix. Alongside that, 2.4.4 permanently drops root privileges in indexer-worker, quota-status and script-login before they serve requests.
◆Where it's heading
The 2.4 line is a rewrite absorbing its own cost. Dependencies are being replaced rather than pinned — libicu swapped for an in-house unicode library, libpcre2 brought in for regular expressions — and the process model is being tightened, with permanent privilege drops and a reworked service_reuse_port that pre-creates one socket per process. IMAP4rev2 and UTF-8 mail remain behind build flags and config toggles, so the modern-protocol work is real but deliberately unshipped.
◆Prediction
Expect the CVE cadence to keep tracking the areas the rewrite touched — auth escaping, IMAP parsing limits and the variable expansion introduced in 2.4 — rather than long-settled code. The experimental IMAP4rev2 and mail_utf8 flags are the obvious candidates to graduate once the security churn slows, though nothing in these entries sets a date.

◆Recent moves

  1. 2mo ago

    Four more CVEs, and root is dropped permanently

    Four vulnerabilities close, including a CRAM channel binding that a MITM with a client-trusted certificate could fake, and a memory exhaustion fix that the previous release had only partly landed. The structural change is quieter: several helper services now drop root permanently before serving requests, which forced restart_request_count down to 1 to keep them working.

    View source ↗
  2. 3mo ago

    Eight CVEs, two of them 2.4 regressions

    The heaviest security release of the line: SQL and LDAP injection both possible when auth_username_chars is configured empty, each explicitly marked a v2.4 regression, plus a replayable OTP driver and non-timing-safe doveadm credential checks. It also removes the OOXML extraction script rather than fix its symlink handling — the cheapest way to close an indexing path.

    View source ↗
  3. 9mo ago

    libicu replaced in-house; IMAP4rev2 lands experimental

    Dovecot drops libicu for its own unicode library while adding libpcre2 as a build dependency — a net rearrangement of what the server links against rather than a reduction. Experimental partial IMAP4rev2 support and client certificate fingerprint auth fields arrive in the same release.

    View source ↗
  4. 1y ago

    First 2.4 patch, carrying the new signing key

    A patch release whose notable content is the 2.4 repository signing key changeover, itself signed by the outgoing key. Operationally relevant to packagers, invisible to anyone running from distribution builds.

    View source ↗
  5. 1y ago

    Dovecot v2.4.0

    ⚡ SPARK

    This is the release the rest of the line is answering to: a configuration format that will not load 2.3 files at all, and a set of default changes that alter how an unmodified server behaves. Every regression CVE in 2.4.3 traces back to code this rewrite touched.

    View source ↗
  6. 1y ago

    Header limits imposed after CPU exhaustion CVEs

    The last 2.3 security release before the rewrite: address header floods and abnormally large headers are now capped at 10 MB per header and 50 MB across a message. It also corrects oauth2 introspection to send credentials via Basic auth as OIDC requires.

    View source ↗