CVE-2019-19722 Null dereference in n/a

What is CVE-2019-19722?

CVE-2019-19722 is a medium-severity vulnerability in Dovecot Dovecot, published on 13 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer Dereference. The email must use a group address as either the sender or the recipient.

Weakness: CWE-476

Which versions are affected by CVE-2019-19722?

It affects 2 products.

Products include Dovecot Dovecot, Fedoraproject Fedora.

How do I fix CVE-2019-19722?

Upgrade to a fixed version.

Is CVE-2019-19722 being exploited?

There is no known exploitation of CVE-2019-19722 in the wild and no public exploit code.

Other vulnerabilities in Dovecot Dovecot

• CVE-2026-24031 Auth bypass in OX Dovecot Pro High 7.7
• CVE-2025-59032 Denial of service in OX Dovecot Pro High 7.5
• CVE-2026-27858 Denial of service in OX Dovecot Pro High 7.5
• CVE-2021-29157 Path traversal in n/a High 7.5
• CVE-2020-10957 Null dereference in n/a High 7.5

All Dovecot Dovecot vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2019-19722, GHSA-cpfv-hj4g-93jr.