2.4.0:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/UYNR6GBP25XEGFCS633SWPR4HXV3NSS3/
"Pigeonhole versioning has been changed to match Dovecot versioning."
"New 2.4 packages are not compatible with old 2.3 configuration, please
carefully review https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html
before installing the new packages."
2.4.1:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/XPT6TA7Y4B4QZZQ2XUE46Z35BDR2X2AA/
2.4.2:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/XTMMPVQ3QKQMYDZ3CZZCXPNHN7OXKS3L/
Fixes CVE-2025-30189:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/G3K5HMBKW6XOYNBXYV5GUM2GR6WPUD4M/
2.4.3:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/IKIHZX77IPTGSP5WBIPJUOFBUQFKVPE7/
Fixes various CVEs:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/I4KFFV4IKP6M5MS67SWYHKDSDMSNILQG/
* CVE-2025-59028: Invalid base64 authentication can cause DoS for other
logins.
* CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks
and read unintended files during indexing. Fixed by dropping the script.
* CVE-2026-24031: SQL injection possible if auth_username_chars is
configured empty. Fixed escaping to always happen. v2.4 regression.
* CVE-2026-27859: Excessive RFC 2231 MIME parameters in email would cause
excessive CPU usage. Fixed by limiting number of parameters to process.
* CVE-2026-27860: LDAP query injection possible if auth_username_chars
is configured empty. Fixed escaping to always happen. v2.4 regression.
* CVE-2026-27857: Sending excessive parenthesis causes imap-login to use
excessive memory.
* CVE-2026-27856: Doveadm credentials were not checked using timing-safe
checking function.
* CVE-2026-27855: OTP driver vulnerable to replay attack.
* CVE-2026-27858: managesieve-login can allocate large amount of memory
during authentication.
* CVE-2025-59032: ManageSieve panic occurs with sieve-connect as a client.
2.4.4:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/YW7GVOH3VVLNAYW2C4TEBTGJW52J7F6H/
Fixes various CVEs:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/YQYBB3NJPNFFJ4SHDU7PLXLRRGHBJKSK/
* CVE-2026-27851: lib-var-expand: Safe filter marks all following pipelines safe.
* CVE-2026-33603: auth: CRAM-SHA-*-PLUS channel binding could be faked.
MITM attacker with a certificate trusted by the client could have
bypassed the requirement for channel binding.
* CVE-2026-40020: IMAP folders can be shared-spammed to everyone.
* CVE-2026-42006: An attacker can cause uncontrolled memory usage with
excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete.
* CVE-2026-40016: sieve :contains and :matches operators could have been
using excessive amount of CPU. Limit the CPU to sieve_max_cpu_time.
2.4.5:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/D7FJQODYCY23BG3FWUZXCJRCLCPT7RZT/
Fixes various CVEs:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/WT4USR35HN43TGQGVDXPDAMCUTGLVMET/
* CVE-2026-27852: Messages with a huge number of From/To/Cc/etc email addresses
could result in excessive memory usage.
* CVE-2026-33263: Submission: Login service crashes with panic once
mail_max_userip_connections limit is reached.
* CVE-2026-33604: The SMTP outbound dot-stuffing mechanism does not properly
escape dots following a bare \r in message bodies, potentially allowing
spoofed emails via malicious end-of-DATA injection.
* CVE-2026-33606: Mail content stored by a user can be crafted so that it is
interpreted as dsync protocol commands when an administrator later runs dsync
with the stream protocol, for example during a migration.
* CVE-2026-33607: IMAP LIST command could be used to cause excessive CPU usage.
* CVE-2026-40014: IMAP THREAD command could have used excessive amount of CPU
processing a single email with a massive number of Message-IDs in References
header.
* CVE-2026-40015: Invalid IMAP command sent to imap-hibernate process might
crash it.
* CVE-2026-40017: IMAP THREAD command could have used excessive amount of CPU
processing emails with a large number of specially crafted Message-IDs in
References header. The fix requires a new dovecot.index.thread file format,
which is enabled only after setting dovecot_storage_version or newer. This
rebuilds the index, so it will cause some extra CPU usage and extra
metacache disk IO usage. It shouldn't cause (much) extra object storage IO,
because all the fields should be coming from dovecot.index.cache.
* CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker
could send mails into a victim's mailbox and observe network traffic to
determine whether a secret message matched a known string by comparing
compressed response sizes (a CRIME-style attack). The fix resets the
compression dictionary after each IMAP command, preventing information from
leaking between commands.
* CVE-2026-40205: If multiple OAUTH scopes were required, then
this could have been only partially enforced with certain
configurations.
* CVE-2026-4200: XCLIENT FORWARD allows to forward key only passdb
fields without the "forward_" prefix which allows connections from
trusted networks to set nopasswd field which allows to skip the
authentication.
* CVE-2026-42391: Pre-login IMAP ID command could have used excessive
amount of memory, causing the process to become killed and disconnecting
all the other IMAP connections being proxied by the process. Or
alternatively it could have caused excessive CPU usage, slowing down
all the other IMAP connections being proxied by the process.
* CVE-2026-42392: If URLAUTH is enabled, sending an invalid IMAP URLFETCH
can result in an untagged NO response containing uninitialized memory,
potentially leaking sensitive data.
* CVE-2026-42393: Doveadm password length or API key length could still
be determined via timing based attacks.
* CVE-2026-42395: XCLIENT FORWARD command from login_trusted_networks
could have been used to cause login processes to crash.
* CVE-2026-52681: Sieve resource usage (sieve_max_cpu_time) was tracked
in the active Sieve binary. Switching to a different active binary
could have been used to reset (bypass) the resource usage.
* CVE-2026-52687: Using IMAP COMPRESS ZSTD command can cause excessive
memory usage in imap-login process, possibly making it reach vsz_limit
and kill all the connections being served by the process. Fixed by
disabling COMPRESS command with all other compression algorithms than
the standard DEFLATE.
* CVE-2026-73208: In oauth2, scope/aud checking was done with JWT tokens.
Now it requires all scopes.
* CVE-2026-73209: Sending IMAP COMPRESS package containing zero-length
frames crashes imap or imap-login process.
* CVE-2026-33605: managesieve-login: Pre-auth crash. An unauthenticated attacker
can crash the ManageSieve login process by sending a small malformed command
before authenticating.
* CVE-2026-40019: v2.4.3 regression: managesieve-login pre-auth infinite loop.
An unauthenticated attacker can send a truncated quoted argument to the
ManageSieve login process, which makes it spin in an infinite loop consuming CPU.
* CVE-2026-42007: sieve-editheader: An attacker that has valid credentials can
use a Sieve script with the editheader extension to trigger a use-after-free
in the mail editing code, and to write memory contents beyond the intended
buffer in the delivered mail.
Removed patches which are included in this release.
Added patch 0001 to revert upstream commit which breaks the build:
CCLD test-var-expand-crypt
output/per-package/dovecot/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/9.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld:
attempted static link of dynamic object `./.libs/var_expand_crypt.so'
Select libiconv when needed, upstream removed the optional support in
verion 2.4.2:
8dd2ec82f6
Added optional dependency to pcre2 available since version 2.4.2:
38fc1545fe
which needs BR2_PACKAGE_PCRE2_32:
https://github.com/dovecot/core/blob/2.4.5/m4/want_pcre.m4#L9
Ported path fixup for Makefile from dovecot to dovecot-pigeonhole to fix
build error:
make[6]: *** No rule to make target
'/usr/libexec/dovecot/settings-history.py', needed by
'settings-history-pigeonhole.h'. Stop.
Updated license hashes due to upstream commits:
8de4423b612a5809c1158020ac1380
Added optional support for libkrb5, openldap, postgresql and zstd.
Removed optional support for xz due to its upstream removal:
3e44364d4a
Removed configure option --with-ssl (openssl is already a dependency):
6b0b7141a8
Removed configure options for zlib (zlib is already a dependency):
d666521754
Renamed RPCGEN value in _CONF_ENV to silence configure warning:
./configure: line 34595: __disable_RPCGEN_rquota: command not found
Removed various _CONF_ENV variables due to their upstream removal:
i_cv_inotify_works:
https://github.com/dovecot/core/pull/107#issuecomment-560056967
i_cv_signed_size_t:
52d322449d
i_cv_signed_time_t:
7cedd93c4e
i_cv_c99_vsnprintf:
5dc503907d
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
In the maze of <div>...</div> blocks, one </div> was missing causing
the rendering to not look great (no vertical spacing between the
panels). This commit adds the missing </div>, fixing the rendering.
Assisted-by: Deepseek V4 Flash
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
We're happy to welcome Texas Instruments (TI) as a sponsor of the
Buildroot Association.
Since Armadeus hasn't (yet?) sponsored this year, we replace them by
TI.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Commit e09bf9e951 ("docs/manual: add information on CycloneDX")
unfortunately introduced a typo. The make target is 'make show-info', not
just 'make show'.
Fix that.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Texas Instrument is a semiconductor company that designs, manufactures
and sells analog and embedded processing chips for markets such as
industrial, automotive, personal electronics, enterprise systems and
communications equipment [1][2].
Thank you for sponsoring LTS maintenance !
[1] https://www.ti.com/
[2] https://www.linkedin.com/company/texas-instruments
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Was missed when the download page was updated for 2026.08-rc3 in commit
e6b06b8d9c ("Update for 2026.08-rc3").
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
patchwork.buildroot.org used to be a redirect to patchwork.ozlabs.org,
but we are now running our own instance, so let's adjust the links in
the website accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
patchwork.buildroot.org used to be a redirect to patchwork.ozlabs.org,
but we are now running our own instance, so let's adjust the links in
the manual accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Even though it's only documentation, the form of the names of the
post-image.sh and post-build.sh scripts should be consistent with the
names of those scripts used in the code base, using hyphen, not
underscore.
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Besides just updating a little terminology, remove the awkward
reference to "his" when referring to developers.
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Users asked where the notes are available and if the information are
publicly available.
Those changes clearly explain the location and convention of the staging
branches and also link to more documentation on how to read the
annotations.
Also update the timing of the different steps to be less specific.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
It has been good practice for a while to describe the kind of change
in the commit message of any patch that changes license file
hashes. This is important so any substantial changes don't go
unnoticed. However it wasn't explicitly stated in the manual, fix
that.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
We changed the suffix of tarballs for Cargo-fetched packages in
commit [1], which affects out-of-tree packages, so it makes sense
to document that in the migration guide.
[1] e8c8bd9bc5
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add link to the commit changing the archive format]
Signed-off-by: Julien Olivain <ju.o@free.fr>
With 8536a5d04a the upstream default
config is used, changing EnableNetworkConfiguration.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
The maintenance and testing workflow sometimes requires to output a
list of every existing package on Buildroot:
- Generating an SBOM of the whole Buildroot tree, e.g. `for
security.buildroot.org
- List every source for every package, e.g. for sources.buildroot.net
The previous solution relied on `make allyesconfig` but always ran into
conflicts that needed manual resolution. Also some packages would not be
present because they are architecture dependent.
To avoid having to manually modify the 'show-info' command this commit
adds the 'show-info-all' command. It accesses the PACKAGES_ALL variable
with all the packages present in Buildroot independently of the
architecture or any config entries.
It forces the `BR2_HAVE_DOT_CONFIG` variable to be set to force the
reading of the package mk files.
It is also added to noconfig_targets, to avoid the .config influencing
the output of show-info-all.
Note that this is not yet a complete solution - it doesn't take into
account the multiple versions that are possible for some packages like
GCC. Also for e.g. linux or uboot the version is empty and the URL is
invalid.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout: refactor with existing show-info]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
As of today, the Buildroot project is now 100% compliant with
OpenSSF Best Practices self-assesment. Let's therefore advertise this
in our SECURITY.md and in the footer of the website.
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Remove the Old stable row, it is now thoroughly EOL.
Also remove the commented-out Candidate row. This update was done with
a (draft) script [1], and the script gets confused by the commented-out
row. The script is able to generate the row for a -rc1 release, so
there is no need for the commented-out row.
[1] https://gitlab.com/buildroot.org/buildroot-lts-tools/-/blob/main/tools/prepare-release?ref_type=heads
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Calian provides a diverse set of mission-critical solutions to solve
complex challenges for customers in defence, space, health and other
critical infrastructure industries.
We thanks them for contributing to the LTS maintenance as a bronze
sponsor.
[1] https://www.calian.com/
[2] https://www.linkedin.com/company/calian/
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
