CVE-2026-42393

A flaw was found in dovecot. The comparison mechanism for doveadm passwords and API keys is not fully timing safe. A remote attacker, with network access to the doveadm service, could repeatedly make requests and accurately measure response timings. This could allow the attacker to learn the length of the configured secret, which reduces the effort needed to guess the secret value. The secret value itself is not directly disclosed by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to the doveadm service to only trusted clients. This can be achieved by configuring firewall rules to limit inbound connections to the doveadm service's port from known, secure IP addresses or subnets. Consult your system's firewall documentation (e.g., firewalld or iptables) for specific configuration steps.