← Vulnerability feed

Vulnerability record · CVE-2020-10967 · published 18 May 2020

CVE-2020-10967: Dovecot improper input validation vulnerability

Dovecot · Dovecot

In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.

5.3 CVSS 3.1 Medium EPSS 8.2% · top 5.3% CWE-20 · Improper input validation
5.3CVSS 3.1 base score, v2 5.0
8.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
26References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00059.html
http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
http://seclists.org/fulldisclosure/2020/May/37 ExploitThird Party Advisory
http://www.openwall.com/lists/oss-security/2020/05/18/1 Mailing ListThird Party Advisory
https://dovecot.org/security Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPF
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQK
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTZN2VW55ZC2AQBGBJMLRJS
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWHUUAFPC6XGIXYFIPTNB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6
https://usn.ubuntu.com/4361-1/
https://www.debian.org/security/2020/dsa-4690
https://www.openwall.com/lists/oss-security/2020/05/18/1 Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00059.html
http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html
http://seclists.org/fulldisclosure/2020/May/37 ExploitThird Party Advisory
http://www.openwall.com/lists/oss-security/2020/05/18/1 Mailing ListThird Party Advisory
https://dovecot.org/security Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPF
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQK
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTZN2VW55ZC2AQBGBJMLRJS
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWHUUAFPC6XGIXYFIPTNB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6
https://usn.ubuntu.com/4361-1/
https://www.debian.org/security/2020/dsa-4690
https://www.openwall.com/lists/oss-security/2020/05/18/1 Mailing ListThird Party Advisory

Track CVE-2020-10967 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-11500Dovecot IMAP quoted-string handling out-of-bounds writeDovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2) mishandles '\0' characters during protocol processing of quoted stri…EPSS 63%analysed9.1CVE-2026-27851Dovecot sql injection vulnerabilityWhen safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe…EPSS 0.58%8.8CVE-2022-30550Dovecot improper authentication vulnerabilityAn issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver …EPSS 2.2%8.2CVE-2026-24031Dovecot sql injection vulnerabilityDovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for…EPSS 0.40%7.8CVE-2019-7524Dovecot memory buffer overflow vulnerabilityIn Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to…EPSS 1.2%7.5CVE-2026-27858Dovecot uncontrolled resource consumption vulnerabilityAttacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force…EPSS 1.0%7.5CVE-2026-27857Dovecot uncontrolled resource consumption vulnerabilitySending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnec…EPSS 0.80%7.5CVE-2025-59028Dovecot improper input validation vulnerabilityWhen sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invali…EPSS 0.45%

Source: NIST National Vulnerability Database (record CVE-2020-10967), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.