CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.

• CWE-20

• http://dovecot.org/pipermail/dovecot-news/2016-December/000333.htmlRelease Notes, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2016/12/02/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/12/05/12Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94639Third Party Advisory, VDB Entry
• http://dovecot.org/pipermail/dovecot-news/2016-December/000333.htmlRelease Notes, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2016/12/02/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/12/05/12Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94639Third Party Advisory, VDB Entry

Published

Feb 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-8646The hash_accept function in crypto/algif_hash.c in the Linux…
• CVE-2016-8647An input validation vulnerability was found in Ansible's mys…4.9
• CVE-2016-8648It was found that the Karaf container used by Red Hat JBoss …7.2
• CVE-2016-8649lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows a…
• CVE-2016-8650The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kern…
• CVE-2016-8651An input validation flaw was found in the way OpenShift 3 ha…3.1
• CVE-2016-8653It was found that the JMX endpoint of Red Hat JBoss Fuse 6, …5.3
• CVE-2016-8654A heap-buffer overflow vulnerability was found in QMFB code …7.8
• CVE-2016-8655Race condition in net/packet/af_packet.c in the Linux kernel…7.8
• CVE-2016-8656Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vul…7
• CVE-2016-8657It was discovered that EAP packages in certain versions of R…
• CVE-2016-8658Stack-based buffer overflow in the brcmf_cfg80211_start_ap f…