| Name | CVE-2026-40018 |
| Description | None None None No publicly available exploits are known. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-6526-1 |
| Debian Bugs | 1146018 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| dovecot (PTS) | bookworm, bookworm (security) | 1:2.3.19.1+dfsg1-2.1+deb12u6 | vulnerable |
| trixie | 1:2.4.1+dfsg1-6+deb13u6 | vulnerable | |
| trixie (security) | 1:2.4.1+dfsg1-6+deb13u7 | fixed | |
| forky | 1:2.4.5+dfsg1-2 | fixed | |
| sid | 1:2.4.5+dfsg1-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| dovecot | source | trixie | 1:2.4.1+dfsg1-6+deb13u7 | DSA-6526-1 | ||
| dovecot | source | (unstable) | 1:2.4.5+dfsg1-1 | 1146018 |
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-40018-mysql-multi-byte-escaping-wrong
Fixed by: https://github.com/dovecot/core/commit/a78c015eae67a891a0c14b5434dd1f99838ae4cc
Fixed by: https://github.com/dovecot/core/commit/7aa8c147eb15009b56c85a00c33c2c0b972c1398
Fixed by: https://github.com/dovecot/core/commit/4190313f6c4945377341017abc50e5239464627c
Fixed by: https://github.com/dovecot/core/commit/710765b420277a6abd7ce9276f7520dcbdf91567
Fixed by: https://github.com/dovecot/core/commit/cf4543ce91058e81daf02b5c3cf8984cc98785b3
Fixed by: https://github.com/dovecot/core/commit/ff926d0c9288f343d18a3c9ec20cf1e252d52286
Fixed by: https://github.com/dovecot/core/commit/98282f1a02d29d6fdd0b3db63ae398d0162fe7bd
Fixed by: https://github.com/dovecot/core/commit/c1a03b211f368d6463eaf9527da9058b0fdc44b5
Fixed by: https://github.com/dovecot/core/commit/ec4cbb78314dc46e77a2abab205969d80708d5f2
Fixed by: https://github.com/dovecot/core/commit/d3a4d4fc2d2c84403df6eea0da1c4b7bd1d887da