CVE-2026-42392

A flaw was found in Dovecot. An attacker with valid credentials can send an invalid IMAP URLFETCH command, leading to the inclusion of uninitialized memory in the error response. This can disclose process memory contents to the client, potentially revealing sensitive data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the IMAP URLAUTH functionality in Dovecot. This can typically be achieved by commenting out or removing the mail_plugins = $mail_plugins imap_urlauth line from your Dovecot configuration file (e.g., /etc/dovecot/conf.d/20-imap.conf or similar). A restart of the Dovecot service is required for the changes to take effect, which may temporarily interrupt mail services.