Medium severity4.3NVD Advisory· Published Aug 28, 2026· Updated Sep 3, 2026
CVE-2026-42392
CVE-2026-42392
Description
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.
Affected products
3- osv-coords2 versionspkg:rpm/opensuse/dovecot24&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/dovecot24&distro=openSUSE%20Tumbleweed
< 2.4.4-160000.2.1+ 1 more
- (no CPE)range: < 2.4.4-160000.2.1
- (no CPE)range: < 2.4.5-1.1
Patches
Vulnerability mechanics
References
1News mentions
1- Dovecot: 17 Vulnerabilities Including Critical Flaws Disclosed Together on August 28, 2026Vypr Intelligence · Aug 28, 2026