CVE-2026-42395

A flaw was found in Dovecot. A remote attacker, if able to send forwarding information from a host configured as a trusted proxy, could send a NUL byte that crashes the login process. This termination of the login process can lead to a denial of service for user logins.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict the login_trusted_networks configuration in Dovecot to only include hosts that are fully under administrative control. This prevents unauthorized hosts from sending malformed forwarding information. After modifying the configuration, the Dovecot service must be reloaded or restarted for the changes to take effect.