Dovecot

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. Dovecot sits in Tier 1, scoped by URL to dovecot/core, so a patch elsewhere in the ecosystem does not reach this ceiling; a secure-by-design memory-safety change carries a 2x multiplier until the end of 2026 and the figure here is the un-multiplied one. Patches must be between one and twelve months old, the maintainers hold a veto, the panel may split the award with them, and it is rate-limited to three submissions a month. Sanctions and territory exclusions apply. CVE history 7 Last 12 months 75 Lifetime Parsing/validation 35 % Memory safety 25 % Denial of service 20 % Auth bypass 15 % Latest advisories Loading the feed Overview Dovecot is the dominant open-source IMAP and POP3 server by a wide margin, and the project has long claimed a majority share of all IMAP servers on the internet. It is the mailbox layer in essentially every self-hosted mail distribution: Mailcow, Mailu, iRedMail, Modoboa, Mail-in-a-Box. Open-Xchange sells it into carrier-scale deployments serving hundreds of millions of mailboxes. A defect in the IMAP command parser is therefore reachable from an authenticated user on a very large fraction of the world's mailboxes at once. The project pays nothing for a vulnerability report; reports go to [email protected] . sorona.xyz pays you directly on qualified, reproduced findings. In scope Reports go to [email protected] and cover the open-source Dovecot server itself. Google's Tier 1 patch ceiling is scoped more tightly, by URL, to the dovecot/core repository The IMAP protocol implementation in full: the command parser, the state machine behind it, and every command a client can issue in any connection state The POP3 and ManageSieve services and the login processes that front them, since those speak to the network on the same box The mail storage layer end to end, covering the Maildir and mbox back ends, mailbox indexes, the cache files and the dsync replication path lib-imap , lib-mail and the shared library code that every service links, where bytes an authenticated client or a stored message supplies are handled The authentication stack in full: SASL, the auth process, the password schemes, and every passdb and userdb driver the server ships The privilege separation between the login process and the mail process, which is the boundary that keeps a compromised pre-authentication parser away from stored mail The LMTP and LDA delivery paths, where a message from an entirely untrusted sender is first parsed and written The doveadm administrative interface and its HTTP API, plus the configuration parser that decides what every service above is allowed to do Out of scope A vulnerability report on its own where the patch money is concerned: that rail pays only on a change merged upstream that then survives a month without reverts One-liner patches that fix non-exploitable crashes, and denial of service by resource exhaustion, which the rules exclude by name Patches outside dovecot/core , Pigeonhole included, reaching for the Tier 1 ceiling, since Google scopes this row to that repository by URL Findings against Open-Xchange's hosted service or its commercial Dovecot Pro features rather than the open-source core Patches the maintainers decline, since Google explicitly declines to second-guess a maintainer's decision Patches older than twelve months or newer than one month at the moment of submission, and anything past three submissions per person per month Most-valued findings A secure-by-design memory-safety improvement across lib-imap and lib-mail , the only work carrying the Tier 1 2x multiplier and the highest-value class here until it expires at the end of 2026. Memory safety is a quarter of the CVE record Pre-authentication memory corruption or parser confusion reachable before the login process hands off, since that is the one surface exposed to anyone who can open a TCP connection Cross-mailbox access: an authenticated user reaching another user's mail through index, cache or namespace handling, which is the failure the entire product exists to prevent. Authentication-stack defects are 15 percent of the record and this is where they land A structural fix to the IMAP command parser that closes a family of defects rather than one command. Parsing and validation is Dovecot's densest bug area at 35 percent of its CVE record, and the top reward band is for changes that almost certainly prevent major vulnerabilities in the affected code Integer-arithmetic errors in mailbox index and cache handling, where a wrapped size or offset makes a later read or write leave the buffer it was meant for Denial of service reachable by a single client, 20 percent of the record, where one connection can take the server down for every other user on it Privilege-separation hardening between the login and mail processes, a named qualifying category that permanently limits what a future parser bug can reach Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report; if we can't reproduce it, it isn't eligible Report to [email protected] , and if you use Open-Xchange's private YesWeHack pathway instead, file with them directly and keep the discussion there. Their terms gag third-party disclosure indefinitely Google scopes the Tier 1 ceiling to the dovecot/core repository by URL; work elsewhere in the ecosystem, Pigeonhole included, does not reach it Open-Xchange's hosted service and its commercial Dovecot Pro features are a different product from the open-source core and are not this target If you also want the Google patch money, land the fix in core yourself and keep it merged without reverts for a month. That is a separate pathway with its own one-to-twelve-month age window and a cap of three submissions a month Disclosure Coordinated with the Dovecot security team at [email protected] , whose fixes ship in the project's own releases. Be careful about the other door: Open-Xchange, Dovecot's commercial steward, runs a private VDP on YesWeHack whose terms impose an indefinite third-party gag and assign IP, so if you go that way, file with Open-Xchange first and keep everything there. sorona.xyz holds anything you share with us until a fix has shipped. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability