dovecot (1:2.4.1+dfsg1-6+deb13u6) trixie-security; urgency=medium
* Security update (Closes: #
1136444)
* [
76ceed4] CVE-2026-27851: lib-var-expand: Reset safe state when
transfer is unset
* [
4af6fb3] CVE-2026-40016: lib-sieve: Enforce CPU time limit within
:contains and :matches matcher loops
* [
366ef61] CVE-2026-33603: login-common: Only accept base64 in sasl
* [
26bd41e] CVE-2026-40020: IMAP folders can be shared-spammed to
everyone.
* [
b6f5bac] CVE-2026-42006: imap-login: Excessive memory usage DoS
[dgit import unpatched dovecot 1:2.4.1+dfsg1-6+deb13u6]