{"action":"Upgrade dovecot to 1:2.4.5+dfsg1-1 or later.","affected":[{"fixed":"1:2.4.5+dfsg1-1","introduced":"0"}],"component":"dovecot","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["1:2.4.5+dfsg1-1"],"id":"tcs_01M5NS0FF6RG6CVX2GN16CREFT","modified_at":"2026-10-01T03:03:04.891533966Z","published_at":"2026-08-28T12:16:29.763Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-42393","https://security-tracker.debian.org/tracker/CVE-2026-42393"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-42393#Debian:14/dovecot","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-42393"}],"summary":"The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service"}