Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

dovecot/core

              main @ b020b25
            

261

Fixes

CVEs

CRITICAL

Peak severity

29.7%

Coverage

Highlights

Auth Bypass: 82 prior fixes. Scrutinize any change in this area.

src/auth/auth-request.c: most-fixed (28 issues). Treat as high-risk during review.

175 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Central authentication logic repeatedly mishandles empty passwords, NUL bytes, and state flags, leading to multiple bypasses.

Auth Bypass: Multiple SASL mechanisms (PLAIN, DIGEST-MD5, SCRAM, GSSAPI, RPA) had parsing or validation flaws enabling authentication bypass.

Improper Certificate Validation: Certificate hostname and validity checks were inconsistently applied, allowing MITM and authentication bypass.