Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-59028

Fixed in a distro release EPSS <1%CVSS 5.3

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.

Published 2026-03-27 · CVE record · OSV

Products: Open-Xchange GmbH OX Dovecot Pro

Distro releases

ReleasePackageFixed in
Alpine 3.23dovecot2.4.3-r0
Alpine 3.24dovecot2.4.3-r0
Debian 13dovecot1:2.4.1+dfsg1-6+deb13u4
Debian 14dovecot1:2.4.3+dfsg1-1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSdovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSdovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSdovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSdovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise Module for Server Applications 15 SP7dovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise Server 15 SP4-LTSSdovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise Server 15 SP5-LTSSdovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise Server 15 SP6-LTSSdovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise Server 16.0dovecot242.4.3-160000.1.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4dovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5dovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6dovecot232.3.21.1-150200.76.1
SUSE Linux Enterprise Server for SAP applications 16.0dovecot242.4.3-160000.1.1
Ubuntu 22.04 LTSdovecot1:2.3.16+dfsg1-3ubuntu2.7
Ubuntu 24.04 LTSdovecot1:2.3.21+dfsg1-2ubuntu6.3
Ubuntu 25.10dovecot1:2.4.1+dfsg1-5ubuntu4.1
openSUSE Leap 16.0dovecot242.4.3-160000.1.1
openSUSE Tumbleweeddovecot242.4.3-1.1