Mailcow (Security-)Updates

Moin Leute,
in der Vergangenheit habe ich es ja schon öfter im Längsten Thread geteilt wenn es Mailcow Updates gab, nun werde ich das hier fortführen.

Ich werde dabei - soweit es geht - immer zum Blog verlinken und den Beitrag hier einmal rein kopieren.

Kurzer Disclaimer: Ich bin selbst "nur" ein Mailcow Benutzer und stehe nicht in Zusammenhang mit "The Infrastructure Company GmbH"

https://mailcow.email/posts/2026/release-2026-05/

Zitat

2026-05b (Release: 21st May 2026)

This update bumps Nginx to version 1.30.1.

Bug Fixes

• [Web] escape HTML in quarantine table by @FreddleSpl0it ➡️ PR #7241

Updates

• [Nginx] Update to 1.30.1 by @FreddleSpl0it ➡️ PR #7240
• Add Uzbek language by @Jahongir-Qurbonov ➡️ PR #7224
• Translations update from Weblate by @milkmaker ➡️ PR #7228
• Update devops-infra/action-pull-request action to v1.1.1 by @renovate[bot] ➡️ PR #7234

Full Changelog

https://github.com/mailcow/mailcow-dockerized/compare/2026-05a…2026-05b

---

2026-05a (Release: 13th May 2026)

Bug Fixes

This update bumps SOGo to version 5.12.8 and thereby addresses 4 security issues. Further details can be found in the SOGo release notes.

We strongly recommend updating to this version.

• [SOGo] Update to 5.12.8 by @FreddleSpl0it ➡️ PR #7226

Full Changelog

https://github.com/mailcow/mailcow-dockerized/compare/2026-05…2026-05a

---

2026-05 (Release: 12th May 2026)

Moohoo everyone!

We’re presenting the 2026-05 Update! This small but important release addresses a security-related issue in the web frontend and ships the usual updates for Postscreen and our Weblate translations.

We strongly recommend updating to this version.

Important Note: The associated CVE identifier will be published separately at a later date.

---

Bug Fixes

• [Web] escape HTML in sieve filter edit view and queue manager by @FreddleSpl0it ➡️ PR #7220

Updates

• [Postfix] update postscreen_access.cidr by @milkmaker ➡️ PR #7177
• [Postfix] update postscreen_access.cidr by @milkmaker ➡️ PR #7209
• Translations update from Weblate by @milkmaker ➡️ PR #7190
• Translations update from Weblate by @milkmaker ➡️ PR #7218

Full Changelog

https://github.com/mailcow/mailcow-dockerized/compare/2026-03b…2026-05

---

That’s all for this release! As always, we recommend keeping your mailcow installation up-to-date and backing up your data regularly.

Stay safe and enjoy!

Your mailcow Team from The Infrastructure Company GmbH (or shortly tinc)

Alles anzeigen

Revision C für 2026-05 inkl. einer gefixten CVE

https://github.com/mailcow/mailcow-dockerized/releases/tag/2026-05c

🐝🐮 Mooay 2026 | Just another security update - Revision C Latest
@FreddleSpl0it FreddleSpl0it released this 2 minutes ago
 2026-05c
 2ac4b1d 
What's Changed
[Nginx] Update to 1.30.2 by @FreddleSpl0it in #7259
fix unbound CVE-2026-33278 by @SYNLINQ in #7252
Update actions/stale action to v10.3.0 by @renovate[bot] in #7242
Translations update from Weblate by @milkmaker in #7245
Update devops-infra/action-pull-request action to v1.1.2 by @renovate[bot] in #7247
Update devops-infra/action-pull-request action to v1.1.3 by @renovate[bot] in #7253
Update devops-infra/action-pull-request action to v1.2.0 by @renovate[bot] in #7254

https://github.com/mailcow/mailcow-dockerized/releases/tag/2026-07b

🏖🐮 Mooly 2026 | Postfix 3.10.12, Rspamd 4.1.0 & Nginx 1.30.3 - Revision B
Repository: mailcow/mailcow-dockerized · Tag: 2026-07b · Commit: 02552ff · Released by: FreddleSpl0it

This release updates Redis, SOGo and ClamAV, addressing multiple security issues.

What's Changed
[Redis] Update to 7.4.10 by @FreddleSpl0it in #7425
[Clamd] Update to 1.4.6 by @FreddleSpl0it in #7415
[SOGo] Update to 5.12.10 by @FreddleSpl0it in #7422
[Web] Minor hardening across web UI and nginx by @FreddleSpl0it in #7426
[Dovecot] Remove legacy DeltaChat auto-filing sieve rule by @FreddleSpl0it in #7423
[Postfix] update postscreen_access.cidr by @milkmaker in #7394
update README.md sponsors by @MaximalBenedikt in #7392
update README.md sponsors by @MaximalBenedikt in #7393
Translations update from Weblate by @milkmaker in #7400

Github war schneller als Website, aber jetzt ist auch der Offizielle Artikel Online

https://mailcow.email/posts/2026/release-2026-09/

Zitat

2026-09 (Release: 21st September 2026)

Moohoo everyone!

We’re happy to present the 2026-09 Update! This release bumps Unbound to 1.26.1, SOGo to 5.12.11 and Redis to 7.4.11. On top of that, the postfix-tlspol container moves to Debian Trixie and version 1.11.0. Rounding things off are two small web UI features and a handful of bug fixes.

---

⚠️ Important Note: All three component updates are security releases. Unbound fixes CVE-2026-81642 (CVSS 9.1) among others, a heap buffer overflow in the DNSSEC validator; the affected code path is exercised by every incoming mail. SOGo addresses password reset poisoning and multiple XSS issues.

We strongly recommend updating your mailcow instance to this version as soon as possible.

---

https://github.com/mailcow/mailcow-dockerized/releases/tag/2026-09

🍂🐮 Mootember 2026 | Unbound 1.26.1, SOGo 5.12.11 & Redis 7.4.11 Latest
@FreddleSpl0it FreddleSpl0it released this 2 minutes ago
 2026-09
 ca07d8d 
What's Changed
Features
[Web] Add ACL + global switch to disable external alias goto by @FreddleSpl0it in #7428
[Web] Add show/hide password toggle on login pages by @FrauJulian in #7342
Fixes
Fix #7150: passwd-verify.lua wipes auth cache during any nginx outage by @wryfi in #7290
[Web] use absolute RHS names in generated DNS zonefile by @smpaz7467 in #7347
[Web] redirect deep links to the matching login page by @smpaz7467 in #7349
[Web] show external sender addresses regardless of authsource by @smpaz7467 in #7376
[Web] translate password errors in the forced password change modal by @smpaz7467 in #7344
Updates
[Unbound] Update to 1.26.1 by @FreddleSpl0it in #7473
[SOGo] Update to 5.12.11 by @FreddleSpl0it in #7475
Update redis Docker tag to v7.4.11 by @renovate[bot] in #7432
postfix-tlspol: upgrade to trixie + 1.11.0 update by @DerLinkman in #7334
Translations update from Weblate by @milkmaker in #7431
[Postfix] update postscreen_access.cidr by @milkmaker in #7450
Translations update from Weblate by @milkmaker in #7457
Translations update from Weblate by @milkmaker in #7460

Nicht nur PHP

2026-10 (Release: 21st October 2026)

Moohoo everyone!

We’re happy to present the 2026-10 Update! This release bumps PHP to 8.2.35, SOGo to 5.12.12 and Nginx to 1.30.6, and all three updates fix security issues. On top of that, the web UI gets a refresh: Bootstrap 5.3.8, a new theme system including a servercow theme, and color-coded login pages.

⚠️ Important Note: All three component updates are security releases:

• PHP 8.2.35 is an out-of-band security release by the PHP project fixing two critical issues in the PHP core (CVSS 9.2). In addition, we disable session.upload_progress, which mailcow does not use.
• SOGo 5.12.12 fixes an IDOR (Insecure Direct Object Reference) vulnerability affecting all previous SOGo versions.
• Nginx 1.30.6 fixes five vulnerabilities, including buffer overflows when using alias with rewrite and in script evaluation, and session forgery with TLS session tickets.