← Vulnerability feed

Vulnerability record · CVE-2016-8652 · published 17 February 2017

CVE-2016-8652: Dovecot auth component crash via aborted authentication without username

Dovecot · Dovecot

Dovecot before 2.2.27, when auth-policy is configured, fails to validate input in the auth component: a remote attacker can abort an authentication attempt without setting a username, crashing the service. The flaw matters because it lets an unauthenticated remote party disrupt mail authentication availability on affected configurations.

5.9 CVSS 3.0 Medium EPSS 48% · top 1.2% CWE-20 · Improper input validation
5.9CVSS 3.0 base score, v2 4.3
48%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityRemote unauthenticated crash is limited to auth-policy deployments and causes only availability loss, but the high EPSS score warrants timely patching.

What it is

Dovecot before 2.2.27, when auth-policy is configured, fails to validate input in the auth component: a remote attacker can abort an authentication attempt without setting a username, crashing the service. The flaw matters because it lets an unauthenticated remote party disrupt mail authentication availability on affected configurations.

Impact

An attacker can cause a denial of service by crashing the Dovecot auth process, interrupting authentication for legitimate users. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable remotely over the network against the Dovecot auth service, with no authentication or user interaction required per the CVSS vector (AV:N/PR:N/UI:N). It only applies when auth-policy is configured, which limits exposure to those deployments.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record. EPSS is high (0.48197, ~98.8th percentile), indicating elevated predicted likelihood of exploitation activity.

What to do

  • Upgrade Dovecot to 2.2.27 or later, which contains the fix.
  • If immediate upgrade is not possible, disable or avoid auth-policy configuration where it is not required.
  • Restrict network access to the Dovecot auth service to trusted clients only.
  • Monitor vendor release notes and mailing list advisories for any follow-up fixes.

Detection

  • Alert on Dovecot auth process crashes or unexpected restarts in service and system logs.
  • Monitor for repeated aborted authentication attempts lacking a username in auth logs.
  • Track availability gaps in mail authentication and correlate with auth-policy configuration changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://dovecot.org/pipermail/dovecot-news/2016-December/000333.html Release NotesVendor Advisory
http://www.openwall.com/lists/oss-security/2016/12/02/4 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/05/12 Mailing ListThird Party Advisory
http://www.securityfocus.com/bid/94639 Third Party AdvisoryVDB Entry
http://dovecot.org/pipermail/dovecot-news/2016-December/000333.html Release NotesVendor Advisory
http://www.openwall.com/lists/oss-security/2016/12/02/4 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/05/12 Mailing ListThird Party Advisory
http://www.securityfocus.com/bid/94639 Third Party AdvisoryVDB Entry

Track CVE-2016-8652 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-11500Dovecot IMAP quoted-string handling out-of-bounds writeDovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2) mishandles '\0' characters during protocol processing of quoted stri…EPSS 63%analysed9.1CVE-2026-27851Dovecot sql injection vulnerabilityWhen safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe…EPSS 0.58%8.8CVE-2022-30550Dovecot improper authentication vulnerabilityAn issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver …EPSS 2.2%8.2CVE-2026-24031Dovecot sql injection vulnerabilityDovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for…EPSS 0.40%7.8CVE-2019-7524Dovecot memory buffer overflow vulnerabilityIn Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to…EPSS 1.2%7.5CVE-2026-27858Dovecot uncontrolled resource consumption vulnerabilityAttacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force…EPSS 1.0%7.5CVE-2026-27857Dovecot uncontrolled resource consumption vulnerabilitySending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnec…EPSS 0.80%7.5CVE-2025-59028Dovecot improper input validation vulnerabilityWhen sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invali…EPSS 0.45%

Source: NIST National Vulnerability Database (record CVE-2016-8652), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.