Vulnerability Database

308,681

Total vulnerabilities in the database

CVE-2019-11500

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

  • Published: Aug 29, 2019
  • Updated: Nov 9, 2025
  • CVE: CVE-2019-11500
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
dovecot / dovecot - 2.2.36.4
dovecot / dovecot 2.3.0 2.3.7.2
dovecot / pigeonhole - 0.5.7.2
debian / debian_linux 8.0 8.0.x
fedoraproject / fedora 30 30.x