UpHeron
All vulnerabilities

Servers and applications

CVE-2017-2669

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all…

Severity
High 7.5
Published
21 Jun 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
4.3% in the next 30 daysHigher than 91% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
DovecotServers and applications · cpe:a:dovecot:dovecot
  • From 2.2.26 up to 2.2.28

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-2669
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-2669