Dovecot, a widely used open-source IMAP and POP3 server that powers email access on many Linux and Unix-like systems, has released version 2.4.5 with a strong focus on security, fixing 19 CVEs while also bringing a handful of useful improvements to search, encryption, and administration.
The release fixes issues that could cause authentication bypasses, denial-of-service attacks, information leaks, email spoofing, and crashes.
These include flaws in SMTP message handling, OAuth2 authentication checks, mailbox synchronization via dsync, and IMAP compression. Some bugs could let specially crafted requests consume excessive CPU or memory, creating potential denial-of-service vectors.
One notable issue could let improperly handled SMTP message data be interpreted in a way that leads to spoofed emails. Another issue affected trusted-network authentication, where certain forwarded fields could be abused to skip normal authentication checks.
Dovecot 2.4.5 also improves IMAP compression security by addressing an information leak related to compressed traffic and fixing additional problems that could cause excessive memory use or crashes.
Beyond security, this update adds phrase searching for the Flatcurve full-text search backend. Previously, a search for several words could match a message simply because all of those words appeared somewhere in it.
With phrase search support, Dovecot can now better distinguish cases where the words actually appear together as a phrase, reducing false-positive search results.
The release also adds support for the ML-KEM-512, ML-KEM-768, and ML-KEM-1024 post-quantum cryptographic algorithms when Dovecot is built with OpenSSL 3.
Administrators also get a new doveadm auth cache status command for checking authentication cache statistics, along with an option to reset those counters. Additionally, configuration handling has been improved with new heredoc syntax for multiline values, making larger configuration blocks easier to manage.
Finally, Dovecot has removed several old and largely unused components, including its OTP authentication mechanism and {OTP} password scheme.
For more details, see the release announcement or check out the project’s GitHub changelog.
Dovecot 2.4.5 is available as pre-built packages from the project repository and as official Docker images. Users upgrading from earlier 2.x versions should review the 2.3 to 2.4 upgrade documentation, especially regarding configuration changes and experimental features in the 2.4 branch.
