Homepage

Allocation of Resources Without Limits or Throttling The advisory has been revoked - it doesn't affect any version of package dovecot-pgsql  (opens in a new tab)

Threat Intelligence

EPSS
0.68% (53rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-DOVECOTPGSQL-15808543
  • published29 Mar 2026
  • disclosed27 Mar 2026
Report a new vulnerability Found a mistake?

Introduced: 27 Mar 2026

CVE-2026-27857  (opens in a new tab)
CWE-770  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream dovecot-pgsql package and not the dovecot-pgsql package as distributed by RHEL.

Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Install fixed version, there is no other remediation. No publicly available exploits are known.

References