The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1416:05 advisory.

    * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0810 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-42006:
    An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in     CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left     open. In particular, the fix was for closing braces, but you could still use open braces to bypass the     limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install     fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are     known.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0245 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-42006:
    An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in     CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left     open. In particular, the fix was for closing braces, but you could still use open braces to bypass the     limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install     fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are     known.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:42091 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:46532 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:46532 advisory.

    * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-46532 advisory.

    [1:2.3.16-8]
    - fix CVE-2026-42006: fix IMAP parser list_count_limit to correctly       limit open braces instead of close braces (RHEL-188480)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:49513 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:44355 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22185-1 advisory.

    This update for dovecot24 fixes the following issues

    - CVE-2026-27851: lib-var-expand: safe filter leaks to all following pipelines (bsc#1265146).
    - CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).
    - CVE-2026-40016: Sieve: contains/: matches O(NxM) substring match bypasses sieve_max_cpu_time limit     (bsc#1265148).
    - CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).
    - CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).

    Changes for dovecot24:

    - Update to 2.4.4

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-96eeb03b88 advisory.

    * CVE-2026-27851: lib-var-expand: Safe filter marks all following pipelines safe.
    * CVE-2026-33603: auth: CRAM-SHA-*-PLUS channel binding could be faked.
      MITM attacker with a certificate trusted by the client could have       bypassed the requirement for channel binding.
    * CVE-2026-40020: IMAP folders can be shared-spammed to everyone.
    * CVE-2026-42006: An attacker can cause uncontrolled memory usage with       excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete.
    * indexer-worker, quota-status, script-login, program-client-local: Root       privileges are now dropped permanently before serving requests.
    * indexer-worker: Default restart_request_count changed to 1 to work       correctly after permanent root privilege drop.
    * lmtp: Add back service_extra_groups=$SET:default_internal_group that was       incorrectly removed in v2.4.3.
    * master: inet_listener_reuse_port has been replaced by service_reuse_port.
      The new setting properly pre-creates all listener sockets at startup and       assigns one unique socket per process. Using this allows evenly distributing       incoming connections to login processes.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:41988 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41988 advisory.

    [1:2.3.21-19.1]
    - fix CVE-2026-42006: fix imap_parser list_count_limit to actually       work (RHEL-188477)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41905 advisory.

    [1:2.3.16-18.1]
    - fix CVE-2026-42006: IMAP parser list_count_limit bypass via open       parentheses (RHEL-188468)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:41905 advisory.

    * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:44357 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
331701	MiracleLinux 8 : dovecot-2.3.16-8.el8_10 (AXSA:2026-1416:05)	Nessus	Miracle Linux Local Security Checks	2026/8/3	2026/8/7	high
333152	TencentOS Server 3: dovecot (TSSA-2026:0810)	Nessus	Tencent Local Security Checks	2026/8/6	2026/8/7	high
333570	Alibaba Cloud Linux 3 : 0245: dovecot (ALINUX3-SA-2026:0245)	Nessus	Alibaba Cloud Linux Local Security Checks	2026/8/10	2026/8/11	high
328357	RHEL 10 : dovecot (RHSA-2026:42091)	Nessus	Red Hat Local Security Checks	2026/7/20	2026/8/24	high
330212	RHEL 8 : dovecot (RHSA-2026:46532)	Nessus	Red Hat Local Security Checks	2026/7/27	2026/8/24	high
330421	RockyLinux 8 : dovecot (RLSA-2026:46532)	Nessus	Rocky Linux Local Security Checks	2026/7/28	2026/8/12	high
330614	Oracle Linux 8 : dovecot (ELSA-2026-46532)	Nessus	Oracle Linux Local Security Checks	2026/7/29	2026/8/11	high
331744	RHEL 7 : dovecot (RHSA-2026:49513)	Nessus	Red Hat Local Security Checks	2026/8/3	2026/8/7	high
329190	RHEL 9 : dovecot (RHSA-2026:44355)	Nessus	Red Hat Local Security Checks	2026/7/23	2026/8/24	high
323080	SUSE SLES16: dovecot24 / dovecot24-backend-mysql / dovecot24-backend-pgsql / etc (SUSE-SU-2026:22185-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/6/26	critical
318245	Fedora 44 : dovecot (2026-96eeb03b88)	Nessus	Fedora Local Security Checks	2026/6/2	2026/6/2	critical
328031	RHEL 10 : dovecot (RHSA-2026:41988)	Nessus	Red Hat Local Security Checks	2026/7/20	2026/8/24	high
328375	Oracle Linux 10 : dovecot (ELSA-2026-41988)	Nessus	Oracle Linux Local Security Checks	2026/7/20	2026/8/24	high
328808	Oracle Linux 9 : dovecot (ELSA-2026-41905)	Nessus	Oracle Linux Local Security Checks	2026/7/21	2026/8/24	high
329048	RockyLinux 9 : dovecot (RLSA-2026:41905)	Nessus	Rocky Linux Local Security Checks	2026/7/22	2026/8/24	high
329194	RHEL 9 : dovecot (RHSA-2026:44357)	Nessus	Red Hat Local Security Checks	2026/7/23	2026/8/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

critical

critical

high

high

high

high

high