#split-protocols.patch
#fix-mail_plugin_dir-default.patch
#ssl-cert-location.patch
#tcpwrapper.patch
#default-mail_location.patch
#mboxlocking.patch
#dovecot_name.patch
#ssl-dh-params-location.patch
skip-rfc-subdir.patch
#Correct-misspellings.patch
#test-backtrace.patch
#doveadm-director.1-drop-acute-accent.patch
#Fix-32bit-sign-comparisons.patch
#Improve-cross-compile-support.patch
#Silence-LTO-related-compiler-warning.patch
#md4-md5-disable-optimization-causing-unaligned-access.patch
#Support-openssl-3.0.patch
#Debug-flaky-unit-test.patch
#auth-Fix-handling-passdbs-with-identical-driver-args-but-.patch
#auth-Add-a-comment-about-updating-userdb_find.patch
#Fix-uninitialized-read-in-doveadm-oldstats.patch
0001-lda-Fix-using-USER-environment-if-d-hasn-t-been-spec.patch
0002-lda-Default-mail_home-HOME-environment-if-not-using-.patch
Use-_FORTIFY_SOURCE-level-3.patch
fit-32-bit-test-integers.patch
bug1104549-gssapi-regression.patch
fix-man-errors.patch
bug1106784_Fix-LDAP-SASL-auth-support.patch
auth__Use_AUTH_CACHE_KEY_USER_instead_of_per-database.patch
auth__Terminate_properly_auth_oauth2_post_setting_defines.patch
lib-sieve_sieve-script_c_sieve_script_create_common_Correctly_handle_errors.patch
bug1121000_dovecot-ldap_Crash_if_iterate_filter_is_set_but_iterate_fields_is_not_set.patch
0001-trash-Use-mailbox-event-in-trash_try_mailbox-for-set.patch
acl-Fix-crash-when-group-ACLs-are-used-but-user-s-ac.patch
CVE-2025-59028.patch
CVE-2025-59031.patch
CVE-2025-59032.patch
CVE-2026-24031-27860-1.patch
CVE-2026-24031-27860-2.patch
CVE-2026-24031-27860-3.patch
CVE-2026-24031-27860-4.patch
CVE-2026-24031-27860-5.patch
CVE-2026-24031-27860-6.patch
CVE-2026-24031-27860-7.patch
CVE-2026-24031-27860-8.patch
CVE-2026-27855-1.patch
CVE-2026-27855-2.patch
CVE-2026-27855-3.patch
CVE-2026-27855-4.patch
CVE-2026-27856-1.patch
CVE-2026-27856-2.patch
CVE-2026-27856-3.patch
CVE-2026-27857-1.patch
CVE-2026-27857-2.patch
CVE-2026-27857-3.patch
CVE-2026-27857-4.patch
CVE-2026-27857-5.patch
CVE-2026-27858.patch
CVE-2026-27859.patch
CVE-2026-27851.patch
CVE-2026-40016.patch
CVE-2026-33603.patch
CVE-2026-40020-1.patch
CVE-2026-40020-2.patch
CVE-2026-40020-3.patch
CVE-2026-42006.patch
lib-mail-istream-header-filter-Fix-potential-assert-.patch
# CVE-2026-52687
0001-imap-Restrict-COMPRESS-to-DEFLATE-only.patch
0002-doveadm-compress-connect-Don-t-hang-when-server-reje.patch
0003-doveadm-compress-Delay-failing-if-used-COMPRESS-algo.patch
# CVE-2026-52681
0001-lib-storage-Allow-NULL-path-in-mailbox_list_mkdir_ro.patch
0002-lib-storage-Simplify-mailbox_mkdir-using-mailbox_lis.patch
0001-lib-sieve-sieve-storage-Add-is_personal-bit.patch
0001-lib-sieve-sieve-storage-Fix-panic-caused-by-flawed-d.patch
0001-lib-sieve-Add-per-user-sieve-rusage-file-for-cumulat.patch
0002-lib-sieve-Drop-binary-header-resource-usage-tracking.patch
0003-lib-sieve-Rename-on-disk-header-rusage-fields-to-unu.patch
0004-lib-sieve-Switch-sieve_max_cpu_time-enforcement-to-t.patch
0005-lib-sieve-file-storage-Remove-orphan-compiled-binari.patch
0006-lib-sieve-Log-a-warning-when-cumulative-CPU-exceeds-.patch
0007-lib-sieve-Log-an-info-line-when-opening-a-CPU-disabl.patch
0008-lib-sieve-Reduce-CPU-limit-check-interval-in-contain.patch
# CVE-2026-42391
0001-imap-login-Add-comments-to-internal-ID-command-param.patch
0001-imap-login-Fix-excessive-memory-growth-with-pre-logi.patch
# CVE-2026-40204
0001-lib-lda-mail-deliver-Autocreate-delivery-mailbox-via.patch
0002-lib-storage-Remove-MAILBOX_FLAG_AUTO_CREATE-and-MAIL.patch
0001-lib-sieve-actions-Split-mailbox-creation-into-sieve_.patch
0002-lib-sieve-actions-Create-fileinto-mailbox-without-th.patch
# CVE-2026-42394
0001-lib-i_close_fd-Document-that-it-preserves-errno.patch
0002-lib-path-util-Add-t_openat_safe-for-jailed-openat-re.patch
0003-lib-Add-t_openat_safe_dir.patch
0004-acl-dovecot-acl-list-is-never-supposed-to-be-a-symli.patch
0005-lib-Add-comments-about-memory-allocations-and-string.patch
0001-lib-sieve-storage-file-Refuse-symlinks-escaping-pers.patch
0002-lib-sieve-storage-file-Validate-script-stat-path-thr.patch
# CVE-2026-73209
0004-lib-compression-test-Add-zero-len-frame-test-for-all.patch
0003-lib-compression-istream-zstd-Guard-against-no-progre.patch
0001-lib-compression-istream-lz4-Ensure-uncompressed-chun.patch
0001-lib-compression-istream-lz4-Try-again-if-no-data-was.patch
0001-lib-compression-Don-t-calculate-crc32-if-using-zlib-.patch
0001-lib-compression-istream-zlib-Use-container_of-macro.patch
0001-global-Fix-spelling.patch
0001-lib-compression-wrap-_read-in-for-loop-reindent-only.patch
0002-lib-compression-Iterate-instead-of-recursing-on-zero.patch
# CVE-2026-40018
0001-lib-sql-sql-api-Implement-async-calls-for-drivers-th.patch
0001-lib-sql-Add-sql_result_new_error-helper.patch
0002-lib-sql-Extract-sql_query_callback_delayed-helper.patch
0003-lib-sql-Add-sql_commit_schedule_delayed-helper.patch
0004-lib-var-expand-Change-escape-func-signature-to-retur.patch
0001-lib-sql-driver-sqlite-Use-sqlite3_snprintf-to-quote-.patch
0001-lib-sql-Use-strchr-based-while-loop-to-fill-template.patch
0005-lib-sql-Make-escape_string-return-int-with-error_r-f.patch
0006-auth-passdb_sql-connect-before-expanding-query-varia.patch
0007-lib-sql-Run-sql-statement-queries-in-their-own-data-.patch
# CVE-2026-40205 and CVE-2026-73208
0001-auth-db-oauth2-Reduce-nesting-in-token_in_scope-via-.patch
0002-auth-db-oauth2-Fix-scope-check-to-require-all-config.patch
0003-auth-db-oauth2-Add-oauth2_audience-setting-deprecate.patch
# CVE-2026-33604
0001-lib-mail-ostream-dot-Optimize-stream-writing.patch
0001-lib-mail-o_stream_dot_sendv-Use-I_MIN.patch
0002-lib-mail-o_stream_dot_sendv-Fix-boundary-off-by-one.patch
0003-lib-mail-o_stream_dot_sendv-Use-enumeration-to-defin.patch
0001-lib-test-Add-test_assert_memcmp.patch
0001-lib-test-Require-both-lengths-in-test_assert_memcmp.patch
0004-lib-mail-o_stream_dot_sendv-Do-not-send-unguarded-.-.patch
# CVE-2026-33607
0001-lib-imap-imap-match-Fix-excessive-CPU-usage-caused-b.patch
# CVE-2026-27852
0001-lib-mail-Reset-charset-translation-buffer-between-MI.patch
0002-imap-Stream-BODYSTRUCTURE-to-client-without-ostream-.patch
0003-imap-Stream-ENVELOPE-to-client-without-ostream-memor.patch
0004-lib-mail-message-parser-from-parts-Enforce-50-MB-all.patch
0005-lib-mail-Add-count-field-to-struct-message_address_l.patch
0006-lib-storage-mbox-Explicitly-disable-the-header-block.patch
0007-lib-mail-istream-header-filter-Use-container_of-for-.patch
0008-lib-mail-Make-istream-header-filter-s-per-header-siz.patch
0009-lib-storage-Cap-per-header-size-in-index_mail_get_he.patch
0010-lib-mail-Clamp-hdr-value-cumulatively-against-header.patch
0011-lib-mail-Introduce-struct-message_part_data_limits-a.patch
0012-lib-mail-Limit-total-address-count-per-message-to-10.patch
0013-lib-mail-Limit-total-Content-Language-tag-count-per-.patch
0014-lib-mail-Limit-total-MIME-parameter-count-per-messag.patch
# CVE-2026-40014
0001-lib-storage-thread-Avoid-excessive-data-stack-growth.patch
0002-lib-storage-thread-Limit-References-header-msgid-cou.patch
0003-lib-storage-thread-Limit-ancestor-chain-traversal-de.patch
# CVE-2026-40013
0001-lib-sieve-sieve-binary-code-Fix-single-byte-oob-stac.patch
# CVE-2026-33605
0001-lib-managesieve-managesieve-parser-Fix-handling-of-l.patch
0002-managesieve-login-client_skip_line-Discard-data-when.patch
# CVE-2026-40015
0001-imap-hibernate-Fix-out-of-bounds-read-when-parsing-D.patch
0002-imap-hibernate-Use-imap-parser-API-for-parsing-DONE-.patch
# CVE-2026-40017
0001-lib-Add-XXH64-hash-implementation.patch
0001-lib-xxh64-fix-byte-ordering-bug-on-big-endian-system.patch
0002-lib-Replace-str_hash-strcase_hash-with-xxh64.patch
0003-lib-Add-str_stable_hash.patch
0004-lib-Key-str_hash-strcase_hash-with-a-random-seed-to-.patch
0005-lib-index-mail-index-strmap-Fix-OOB-read-from-trunca.patch
0006-lib-index-Rename-crc32-variables-parameters-to-hash-.patch
0007-lib-index-Add-keyed-xxh64-strmap-format-v2-gated-by-.patch
0008-doveadm-Fix-ubsan-unsigned-integer-overflow-error.patch
0009-config-Assume-dovecot_config_version-0.0.0-is-the-sa.patch
0010-lib-master-Move-config_version_find-from-src-config-.patch
0011-lib-lib-master-Move-version_-to-lib-version.-ch.patch
0012-config-doveconf-dF-Add-dovecot_storage_version.patch
# CVE-2026-42007
0001-lib-sieve-util-edit-mail-Fix-writing-to-freed-memory.patch
0002-lib-sieve-util-test-edit-mail-Adjust-to-changes-in-d.patch
0003-lib-sieve-edit_mail_headers_parse-Fix-info-leak-via-.patch
# CVE-2026-33263
0001-login-common-client-common-Add-client_disconnect-vfu.patch
0002-submission-login-client-Fix-panic-occurring-at-mail_.patch
0003-lib-smtp-smtp-server-Expose-smtp_server_connection_r.patch
0004-submission-login-client-authenticate-Reply-421-4.7.0.patch
0001-commin-Rename-LOGIN_PROXY_FAILURE_TYPE_AUTH-to-LOGIN.patch
0001-managesieve-login-Adjust-to-core-s-login_proxy_failu.patch
0001-login-common-login-Add-proxy_dest_connection_limit-e.patch
0005-submission-login-submission-proxy-Recognize-421-4.7..patch
0001-managesieve-login-Support-LOGIN_PROXY_FAILURE_TYPE_A.patch
0001-login-Add-LOGIN_PROXY_FAILURE_TYPE_AUTH_NOT_REPLIED.patch
# CVE-2026-33606
0001-dsync-Avoid-potentially-excessive-data-stack-growth-.patch
0002-dsync-Fix-escaping-mail-or-attribute-value-that-begi.patch
# CVE-2026-40203
0001-imap-Extract-side-channel-ostream-creation-into-help.patch
0002-imap-Recreate-multiplex-ostream-side-channel-after-u.patch
0003-lib-compression-Add-o_stream_deflate_reset_dict.patch
0004-imap-login-Add-dict_reset-side-channel-command-to-im.patch
# CVE-2026-42008
0005-imap-Add-imap_compress_on_proxy-hidden-setting.patch
0006-imap-Reset-DEFLATE-dictionary-after-every-tagged-rep.patch
0001-submission-Fix-settings-leak-on-error-paths-in-clien.patch
0002-auth-Fix-prefixing-forward_fields-without-a-value-fr.patch
# CVE-2026-42392
0001-lib-imap-urlauth-Fix-leaking-uninitialized-memory-in.patch
# CVE-2026-42393
0001-lib-Add-str_equals_timing_safe.patch
0002-doveadm-Avoid-leaking-doveadm_password-or-doveadm_ap.patch
# CVE-2026-42395
0001-login-common-Fix-crash-when-XCLIENT-FORWARD-base64-c.patch
0002-login-common-Avoid-array_front-panic-on-empty-forwar.patch
