CVE-2017-15132

A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.

• CWE-400
• CWE-772

• https://bugzilla.redhat.com/show_bug.cgi?id=1532768Issue Tracking, Patch, Third Party Advisory
• https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patchPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/03/msg00036.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3556-1/Third Party Advisory
• https://usn.ubuntu.com/3556-2/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4130Third Party Advisory
• https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1532768Issue Tracking, Patch, Third Party Advisory
• https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patchPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/03/msg00036.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3556-1/Third Party Advisory
• https://usn.ubuntu.com/3556-2/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4130Third Party Advisory
• https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlVendor Advisory

Published

Jan 25, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15126A use-after-free flaw was found in fs/userfaultfd.c in the L…8.1
• CVE-2017-15127A flaw was found in the hugetlb_mcopy_atomic_pte function in…
• CVE-2017-15128A flaw was found in the hugetlb_mcopy_atomic_pte function in…
• CVE-2017-15129A use-after-free vulnerability was found in network namespac…4.7
• CVE-2017-15130A denial of service flaw was found in dovecot before 2.2.34.…
• CVE-2017-15131It was found that system umask policy is not being honored w…
• CVE-2017-15133A denial of service flaw was found in miekg-dns before 1.0.4…
• CVE-2017-15134A stack buffer overflow flaw was found in the way 389-ds-bas…
• CVE-2017-15135It was found that 389-ds-base since 1.3.6.1 up to and includ…
• CVE-2017-15136When registering and activating a new system with Red Hat Sa…
• CVE-2017-15137The OpenShift image import whitelist failed to enforce restr…4.3
• CVE-2017-15138The OpenShift Enterprise cluster-read can access webhook tok…5