CVE-2019-19722: In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push...

Security readout for executives and security teams

This flaw affects Dovecot mail servers before 2.3.9.2 when push notifications are enabled. A specially crafted email using a group address as sender or recipient can crash the push-notification driver. The described impact is availability loss for that component, not mailbox compromise. Exposure is limited to Dovecot installations before 2.3.9.2 that use push notifications. Organizations not running Dovecot, already patched, or not using the push-notification driver are less likely to be affected based on the provided sources. Treat this as a targeted availability risk for mail notification infrastructure. Prioritize patching internet-facing or high-dependency mail systems using Dovecot push notifications, but do not treat it as confirmed active exploitation from the provided evidence. Mitigation focus: Upgrade Dovecot to 2.3.9.2 or a fixed vendor package.; Apply relevant Fedora or distribution security updates where applicable.; Identify whether Dovecot push notifications are enabled before prioritizing rollout..

Prepared

Jun 6, 2026, 03:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.