LoginSign Up
← Back to all sparks
D

Dovecot

COMMS
Velocity2.5

Open-source IMAP and POP3 mail server

www.dovecot.org ↗

Dovecot's 2.4 branch is being hardened release by release after a breaking rewrite.

email-infrastructureimapsecurity-hardeningcve-responsecryptographybreaking-changes
◆Current state
Dovecot is the IMAP and POP3 server behind a large share of the world's mailboxes. The 2.4 branch opened in January 2025 with a deliberately incompatible release — configuration files must be rewritten, the plugin section is gone, and several long-standing features were removed outright — and every release since has been consolidation on top of it. The pattern is consistent: each point release leads with critical CVE fixes, then lists incremental changes. The latest, 2.4.5, carries twelve CVEs alongside post-quantum ML-KEM support, full-text phrase searching and a throttling response code.
◆Where it's heading
Two things are being worked at once. Security is the visible half, and the volume is striking — resource-exhaustion and parser issues in IMAP THREAD, LIST and ID, a CRIME-style compression side channel, an authentication bypass through XCLIENT forwarding. The quieter half is that fixes are increasingly gated behind version declarations: the THREAD fix needs a new index format enabled only by raising dovecot_storage_version. That mechanism, introduced with 2.4.0, is now doing real work, letting operators take format changes on their own schedule.
◆Prediction
Experimental flags for mail UTF-8 and IMAP4rev2 have carried unchanged through every 2.4 release so far; the next branch-defining move is one of those graduating to default rather than another security round.

◆Recent moves

  1. 19d ago

    Twelve CVEs fixed; ML-KEM and full-text phrase search arrive

    The largest security round of the branch: twelve CVEs spanning IMAP THREAD, LIST and ID resource exhaustion, a CRIME-style leak via IMAP compression, dot-stuffing escape failures in SMTP output, and an XCLIENT forwarding bypass that let trusted networks skip authentication. Alongside them, ML-KEM support in lib-dcrypt, phrase searching in fts-flatcurve and a THROTTLED response code. The THREAD fix ships behind a new index format operators opt into via dovecot_storage_version.

    View source ↗
  2. 4mo ago

    CVE fixes in variable expansion and CRAM-SHA authentication

    Fixes a variable expansion flaw where a safe filter marked all following pipelines safe, plus a CRAM-SHA authentication issue. Same shape as the rest of the branch — security first, incremental changes after.

    View source ↗
  3. 5mo ago

    CVE fixes for base64 auth DoS and decode2text

    Addresses a denial of service where invalid base64 authentication disrupted other logins, along with a decode2text issue. Routine maintenance on the 2.4 line, with the experimental UTF-8 and IMAP4rev2 flags still carried forward unchanged.

    View source ↗
  4. 10mo ago

    Auth cache key collision fixed; libpcre2 becomes a dependency

    Fixes a cache-key collision where several passdb and userdb drivers stored different users under the same auth cache key, and introduces a libpcre2 dependency. The dependency change is the operational note — it affects anyone building rather than installing packages.

    View source ↗
  5. 1y ago

    2.4 branch signing key rotates; packages break 2.3 configs

    The first follow-up to the branch opening, rotating to a new 2.4 signing key and repeating the warning that 2.4 packages will not run against 2.3 configuration. Housekeeping in service of a migration operators had to plan around.

    View source ↗
  6. 1y ago

    Dovecot 2.4 lands: configs must be rewritten, director removed

    ⚡ SPARK

    The release that defines everything after it. Every later entry in this feed is maintenance on the structure 2.4.0 imposed, including the storage and config versioning that now lets security fixes ship format changes safely.

    View source ↗