CVE-2020-7046: Dovecot

High severity, CVSS 7.5. EPSS: 51.3% chance of exploitation in the next 30 days.

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.

Affected products

• Dovecot Dovecot: from 2.3.9, before 2.3.9.3 (fixed in 2.3.9.3)
• Fedoraproject Fedora: version 30 only; version 31 only

Published 2020-02-12. Last modified 2026-06-17.