CVE-2026-42007

Red Hat statement

This flaw requires an attacker to authenticate with valid credentials before it can be exploited, and exploitation additionally depends on the Sieve `editheader` extension being enabled, which is not Dovecot's default configuration. Because the CVSS attack vector requires low-privileged authentication (PR:L) rather than unauthenticated remote access, and the confirmed impact is primarily memory corruption leading to a crash of the mail delivery process, this issue is rated Important rather than Critical. Disabling the Sieve `editheader` extension fully mitigates the vulnerability without requiring a package update.

Red Hat mitigation

To mitigate this vulnerability, disable the Sieve `editheader` extension in the Dovecot configuration. After modifying the configuration, the Dovecot service must be restarted for the changes to take effect. Disabling this extension will remove its associated functionality.