Vulnerability record · CVE-2019-11500 · published 29 August 2019
CVE-2019-11500: Dovecot IMAP quoted-string handling out-of-bounds write
Dovecot · Dovecot
Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2) mishandles '\0' characters during protocol processing of quoted strings, causing out-of-bounds writes. The flaw is remotely reachable and can lead to remote code execution, making it a serious risk for exposed mail servers.
Description
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication, and public exploit references, though not in KEV.
What it is
Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2) mishandles '\0' characters during protocol processing of quoted strings, causing out-of-bounds writes. The flaw is remotely reachable and can lead to remote code execution, making it a serious risk for exposed mail servers.
Impact
An unauthenticated remote attacker can corrupt memory in the Dovecot process and potentially execute arbitrary code, gaining control of the mail server or causing denial of service.
Attack surface
Reached over the network through Dovecot's protocol handling of quoted strings; the CVSS vector indicates no privileges or user interaction are required. The record does not specify which exact protocol commands are affected.
Exploitation
Not listed in CISA KEV, but EPSS is 0.62579 (99th percentile) and an Openwall reference is tagged 'Exploit', indicating public exploit material exists. No ransomware usage is documented.
What to do
- Upgrade Dovecot to 2.2.36.4 or 2.3.7.2 (or later) and Pigeonhole to 0.5.7.2 or later.
- Apply vendor errata for packaged builds (Red Hat RHSA-2019:2822, RHSA-2019:2836, RHSA-2019:2885; Debian, Fedora, openSUSE, Gentoo advisories).
- Restrict network exposure of IMAP/POP3/LMTP services to trusted networks or VPN where possible.
- Monitor vendor advisories for backported fixes if immediate upgrade is not feasible.
Detection
- Monitor Dovecot logs for crashes, restarts or abnormal process termination that could indicate memory corruption attempts.
- Watch for unexpected child process spawns or outbound connections from the Dovecot service account.
- Use host-based memory integrity or EDR alerts on Dovecot processes for anomalous behavior.
- Track exploit attempts against IMAP/POP3 endpoints via network IDS signatures if available.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-11500 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-11500), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
