Safe upgrade path from 2.4.1 to 2.4.4 (CVE-2026-40020) on Debian 13

Hello,

(Redirected here from [email protected] - I understand that address is
for commercial/Pro support, and this is a Community Edition question.)

We run a production mail server on Debian GNU/Linux 13 (trixie), using the
Dovecot package currently shipped in the Debian 13 stable repository:

  dovecot-core 1:2.4.1+dfsg1-6+deb13u6

We are affected by CVE-2026-40020 ("IMAP folders can be shared-spammed to
everyone"), which as far as we understand is fixed upstream in Dovecot
2.4.4. Debian 13 stable does not yet ship a backported fix, so we are
currently working around the issue by not using shared/ACL mailbox access
at all, and waiting for an official Debian security update.

We would appreciate the community's guidance on a few points:

1. Is a safe, supported upgrade path from 2.4.1 to 2.4.4 recommended for a
   production instance currently installed from Debian's own package
   (rather than compiling from source or using a third-party repository)?

2. Are there any breaking changes between 2.4.1 and 2.4.4 we should be
   aware of - configuration syntax, Maildir index file format compatibility,
   or anything that would require downtime or re-indexing on a live mail
   store?

3. Our setup uses SQL-based virtual users/passdb (via PostfixAdmin/MySQL),
   Sieve filtering, and per-user quotas. Are there any known interactions
   between these features and the 2.4.4 update that we should test for
   before rolling it out?

4. Do you have a general recommendation on whether to wait for the Debian
   security team to backport the fix into 13 stable, versus updating
   manually ahead of that?

Any guidance, or a pointer to relevant release notes/changelog entries
between 2.4.1 and 2.4.4, would be very helpful.

Thank you,
Artem Ignatov
IT Administrator, GK INVEST

_______________________________________________
dovecot mailing list -- [email protected]
To unsubscribe send an email to [email protected]