Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Dovecot bug bounty programs

dovecot.org Updated

Dovecot runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
10
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Dovecot runs.

  • Dovecot

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

10 targets. 6 excluded.

  • https://www.dovecot.org

    Web

  • lib-imap, lib-mail and the shared library code that every service links, where bytes an authenticated client or a stored message supplies are handled

    Products and areas

  • Reports go to [email protected] and cover the open-source Dovecot server itself. Google's Tier 1 patch ceiling is scoped more tightly, by URL, to the dovecot/core repository

    Products and areas

  • The authentication stack in full: SASL, the auth process, the password schemes, and every passdb and userdb driver the server ships

    Products and areas

  • The doveadm administrative interface and its HTTP API, plus the configuration parser that decides what every service above is allowed to do

    Products and areas

  • The IMAP protocol implementation in full: the command parser, the state machine behind it, and every command a client can issue in any connection state

    Products and areas

  • The LMTP and LDA delivery paths, where a message from an entirely untrusted sender is first parsed and written

    Products and areas

  • The mail storage layer end to end, covering the Maildir and mbox back ends, mailbox indexes, the cache files and the dsync replication path

    Products and areas

  • The POP3 and ManageSieve services and the login processes that front them, since those speak to the network on the same box

    Products and areas

  • The privilege separation between the login process and the mail process, which is the boundary that keeps a compromised pre-authentication parser away from stored mail

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A vulnerability report on its own where the patch money is concerned: that rail pays only on a change merged upstream that then survives a month without reverts

  • Findings against Open-Xchange's hosted service or its commercial Dovecot Pro features rather than the open-source core

  • One-liner patches that fix non-exploitable crashes, and denial of service by resource exhaustion, which the rules exclude by name

  • Patches older than twelve months or newer than one month at the moment of submission, and anything past three submissions per person per month

  • Patches outside dovecot/core, Pigeonhole included, reaching for the Tier 1 ceiling, since Google scopes this row to that repository by URL

  • Patches the maintainers decline, since Google explicitly declines to second-guess a maintainer's decision

Recent changes

Reward and scope changes across every Dovecot program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Dovecot products, from the NVD.

Search NVD
  • CVE-2026-42006 Medium

    An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Insta

  • CVE-2026-40016 Medium

    Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publi

  • CVE-2026-40020 Low

    Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.

  • CVE-2026-33603 Medium

    Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.

  • CVE-2026-27851 High

    When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

  • CVE-2026-27855 Medium

    Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communca

  • CVE-2026-27856 High

    Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.

  • CVE-2026-27857 Medium

    Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching

About this page

This page gathers every public program listed under dovecot.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.