Dovecot and Roundcube: IMAP and webmail security updates

Updated November 2026

Dovecot holds your users' mailboxes and Roundcube puts them on the web. Both had many security releases in 2026. Run a supported branch (Dovecot 2.4, Roundcube 1.7 or 1.6 LTS), install updates as soon as they appear, and restart Dovecot after every package update.

What they are

Dovecot is an IMAP and POP3 server. Mail clients log in to it to read mail. It often also handles password checks (SASL) for Postfix or Exim, and runs Sieve filters through its Pigeonhole add-on. Roundcube is a PHP webmail application that talks to Dovecot over IMAP. Both are common on hosting servers and control panels.

Dovecot's login processes accept connections before authentication, and Roundcube shows untrusted HTML mail in the browser. Both kinds of code are frequent sources of security bugs.

Check the installed version

dovecot --version                    # e.g. 2.4.5 (…)
sudo doveconf -n | head -n 3         # config version line and any errors

# Roundcube: the version is defined in program/include/iniset.php
grep RCMAIL_VERSION /var/www/roundcube/program/include/iniset.php
grep RCMAIL_VERSION /usr/share/roundcube/program/include/iniset.php   # Debian/Ubuntu package

Change the path to where your Roundcube lives. Also check where the packages come from. A distribution's patched Dovecot 2.3 is safe even though upstream no longer supports 2.3:

apt policy dovecot-core roundcube-core     # Debian / Ubuntu
rpm -q dovecot roundcubemail               # RHEL family (roundcubemail is in EPEL)

Supported upstream versions

Upstream support, as of November 2026
SoftwareBranchLatest releaseStatus
Dovecot CE2.42.4.5 (August 28, 2026)Current
Dovecot CE2.3—End of life (listed under "End of Life" on dovecot.org)
Roundcube1.71.7.5 (October 19, 2026)Stable
Roundcube1.61.6.20 (October 19, 2026)LTS: important security fixes only
Roundcube1.5 and older1.5.15 (March 29, 2026)No longer supported

Dovecot and Pigeonhole 2.4.5 fixed a long list of CVEs. Several were rated high on dovecot.org, among them a pre-login ManageSieve crash and a Sieve editheader use-after-free (a memory-handling bug). Earlier security releases came in March and May 2026. Dovecot 2.4 uses a new configuration format. Use the configuration upgrader on dovecot.org to convert a 2.3 config before you switch.

Roundcube released security updates for 1.6 and 1.7 almost every month in 2026. The October 19 releases fixed about 20 issues, including IMAP command injection, mail header injection, cross-site scripting (XSS: script code planted in a page) and a CSRF bypass (CSRF: tricking a logged-in user's browser into sending a request). When 1.7.0 came out on May 10, 2026, the project said 1.5 "is no longer supported and maintained" and that 1.6 would "only receive important security updates." Roundcube 1.7 needs PHP 8.1 or later.

Distro packages or project repository

Distribution packages
Debian, Ubuntu, RHEL (Dovecot in the base OS, Roundcube in EPEL), SUSE, Alpine and FreeBSD all package both. The distribution's security team backports fixes into the version it shipped, so a Debian 12 server can stay on Dovecot 2.3 safely until Debian 12 support ends. Roundcube packages are sometimes slower to get fixes than upstream. Compare the package changelog with the Roundcube news page.
repo.dovecot.org
Dovecot runs community repositories with current 2.4 builds, for example Debian 12 and 13 and Ubuntu 26.04 (2.4.5 dropped Ubuntu 22.04). They come with "no official support, warranty, or SLAs". Use them when you want upstream 2.4 releases, not backports.
Roundcube tarball
Many sites install Roundcube from the "complete" package on roundcube.net. You then update it yourself with the project's script (below). No package manager will do it for you.

Update commands

# Debian / Ubuntu
sudo apt update
sudo apt install --only-upgrade dovecot-core dovecot-imapd dovecot-pop3d \
     dovecot-sieve dovecot-managesieved roundcube roundcube-core

# RHEL, Rocky, AlmaLinux
sudo dnf upgrade --refresh 'dovecot*' roundcubemail

# SUSE / openSUSE
sudo zypper refresh
sudo zypper update 'dovecot*'

# Alpine
sudo apk update
sudo apk upgrade dovecot roundcubemail

# FreeBSD (packages; Roundcube's package name includes the PHP version)
sudo pkg update
sudo pkg upgrade dovecot dovecot-pigeonhole
pkg info | grep -i roundcube        # then: sudo pkg upgrade <that name>

With --only-upgrade, apt skips listed packages that are not installed. On the other systems, quote the wildcards so the shell does not expand them.

Roundcube from the tarball

Back up the Roundcube folder and its database first. Download the new "complete" package from roundcube.net, check it, and unpack it in a temporary folder, not over your install. Then run the update script from inside that folder:

cd /tmp/roundcubemail-1.7.5
sudo ./bin/installto.sh /var/www/roundcube

The script copies the new files, then checks and updates the configuration and database schema. Afterwards, make sure the files have the right owner for your web server. If you unpack with tar, the --no-same-owner option helps. If PHP itself is old, see updating PHP.

Check the config, then restart

sudo doveconf -n > /dev/null && echo "Dovecot config OK"
sudo systemctl restart dovecot          # Alpine: rc-service dovecot restart; FreeBSD: service dovecot restart

This restarts Dovecot. Open IMAP sessions are dropped and mail clients reconnect on their own. doveadm reload only re-reads the configuration; after a package update, restart. If Dovecot also does SMTP authentication for Postfix or Exim, test a mail client login and a send afterwards.

Roundcube runs inside PHP, so new files take effect on the next request. If you use PHP-FPM with OPcache, restart or reload PHP-FPM so it does not serve old cached code. See restarting after an update.

Verify

Where advisories are published

Quick hardening tips

Sources