{"action":"Upgrade dovecot to 1:2.3.19.1+dfsg1-2.1+deb12u7 or later.","affected":[{"fixed":"1:2.3.19.1+dfsg1-2.1+deb12u7","introduced":"0"}],"component":"dovecot","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["1:2.3.19.1+dfsg1-2.1+deb12u7"],"id":"tcs_01M5NSQVB8ET08M83W2H1DK4A5","modified_at":"2026-10-31T16:04:23.129821473Z","published_at":"2026-08-28T12:16:30.010Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-52681","https://security-tracker.debian.org/tracker/CVE-2026-52681"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-52681","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-52681"}],"summary":"Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also"}