LoginSign Up
← Back to all sparks
M

mailcow

COMMS
Velocity5.0

Dockerized open-source mail server suite

mailcow.email ↗

mailcow's November release patches an admin RCE and reworks sync jobs.

mail-serverself-hostedsecurity-updatesbreaking-changesimapsync
◆Current state
mailcow ships named monthly releases with lettered revisions, mostly to pull in upstream security fixes for SOGo, Nginx, Redis, Unbound and Rspamd. The November release goes further: it fixes a remote code execution flaw reachable by admins and domain admins, adds mailbox groups, and reworks imapsync so sync jobs reference a separate source. It also caps request bodies at 64 MB, which breaks large SOGo and ActiveSync mail unless NGINX_MAX_BODY_SIZE is raised.
◆Where it's heading
The monthly security cadence holds, but recent releases carry more of mailcow's own features and API changes alongside the upstream bumps. Breaking changes now come with explicit migration steps, which suggests the API is being cleaned up for integrators.
◆Prediction
Expect the promised RCE advisory details next week and a lettered revision within weeks to address fallout from the sync job API and body-size changes.

◆Recent moves

  1. 9d ago

    Moovember 2026: admin RCE fix, mailbox groups, imapsync rework

    A larger-than-usual monthly release: it fixes an RCE exploitable by admins and domain admins, adds mailbox groups and reworks imapsync around separate sync sources, with breaking API and body-size changes. It goes beyond the usual upstream-bump pattern.

    View source ↗
  2. 23d ago

    🎃🐮 Mooctober 2026 | Security Update: PHP 8.2.35, SOGo 5.12.12 & Nginx 1.30.6

    mailcow's October update moves PHP to an Alpine 3.24 base and updates SOGo to 5.12.12 and Nginx to 1.30.6 as security updates, alongside a UI update.

    View source ↗
  3. 1mo ago

    2026-09a: Rspamd 4.2.1 and postfix-tlspol bumps

    A revision release bumping postfix-tlspol and Rspamd and updating postscreen access data. Routine component maintenance.

    View source ↗
  4. 1mo ago

    🍂🐮 Mootember 2026 | Unbound 1.26.1, SOGo 5.12.11 & Redis 7.4.11

    Alongside Unbound, SOGo and Redis updates, admins get an ACL and global switch to block external alias forwarding, and an auth-cache wipe during nginx outages is fixed. Small admin controls on top of the usual upstream currency.

    View source ↗
  5. 2mo ago

    🏖️🐮 Mooly 2026 | Postfix 3.10.12, Rspamd 4.1.0 & Nginx 1.30.3 - Revision B

    Redis 7.4.10, ClamAV 1.4.6, and SOGo 5.12.10 pulled in for multiple security issues, plus minor hardening across the web UI and nginx and removal of a legacy DeltaChat auto-filing sieve rule. The second revision of the Mooly release and the fourth consecutive entry driven by upstream security work.

    View source ↗
  6. 3mo ago

    🏖️🐮 Mooly 2026 | Postfix 3.10.12, Rspamd 4.1.0 & Nginx 1.30.3 - Revision A

    Rspamd 4.1.4, a fix for nginx CVE-2026-42533, and general hardening, alongside real bug fixes - quarantine subject display restored, IPv6 default_server binding gated on ENABLE_IPV6, time-limited aliases no longer silently discarded. Flagged as strongly recommended.

    View source ↗