49 Releases 53 Tags

RSS Feed

• v2026.10.29.1 932b032e78

  Compare

  INBUXA 2026.10.29.1 Stable

  jcoffey-dev released this 2026-10-29 13:42:54 +00:00 | 116 commits to main since this release

  This release fixes 7 security issues we found in our own review of the server, all medium. All versions up to and
  including 2026.10.29, and 27.1-rc.1 to 27.1-rc.2, are affected. Please upgrade.

  Some fixes change behavior that operators, clients or users can notice. Read "Behavior changes" before upgrading.

  Security

  Medium

  • OpenID Connect directories: tokens issued to other applications could sign in (GHSA-v3gv-4j87-3mg2)
  • OpenID Connect directories: opaque tokens from any application could sign in (GHSA-2p7h-9hv3-4292)
  • Calendars: one calendar object could cost tens of seconds of CPU to expand (GHSA-pw47-x75c-v45r)
  • IMAP: one session could start an unbounded number of operations at once (GHSA-6x5j-v349-9v79)
  • Sieve: a script's CPU limit did not count the message it scanned (GHSA-whf3-4g3x-w7r6)
  • Sign-in: bearer tokens were offered and accepted on unencrypted connections (GHSA-5phc-xg42-vp24)
  • OpenID Connect directories: provider responses were read without a size limit (GHSA-6hcw-cw8m-jcx7)

  Behavior changes

  Sign-in and tokens

  • OAuth bearer sign-in (OAUTHBEARER, XOAUTH2) now always needs TLS in IMAP, POP3, ManageSieve and SMTP submission.
    On unencrypted connections those mechanisms are no longer offered or accepted, even with plain-text sign-in
    allowed. A proxy that terminates TLS has to report it through the proxy protocol. Password sign-in is unchanged.
  • New OpenID Connect directories must set a required audience (the client ID registered for this server). Existing
    directories without one keep working, log a warning each time they load, and appear on the Security to-do list; a
    later release will require it. An audience, once set, can't be removed.
  • OpenID Connect directories have a new opaque-token setting: reject, check by token introspection (RFC 7662, with a
    client ID and secret), or accept on the user info endpoint's word. New directories reject opaque tokens unless an
    introspection endpoint is set. Existing directories keep accepting them through user info, as before; set the
    policy to close the hole.
  • Responses from an OpenID Connect provider larger than 1 MiB are refused. A token without a key ID is checked
    against freshly fetched provider keys when the cached ones don't verify it, so a key rotation no longer breaks such
    tokens until a reload.

  Mail and calendars

  • IMAP: a session runs at most four read operations at once, and commands that change mail or the session run one at
    a time in the order sent. A NOOP or LOGOUT sent during a long FETCH answers after it.
  • Sieve: the CPU limit (max_cpu_cycles) also counts the message bytes that tests scan. Every 64 KiB compared, times
    the number of keys, costs one instruction, so a user's script can scan about 300 MiB per message by default. A
    script that goes over stops with the usual CPU-limit error and the message is kept. Scripts running many
    body :raw tests on very large messages hit the limit sooner.
  • Calendars: recurrence expansion has one work limit per calendar object (about 50 ms). Objects whose rules use it
    up are still stored with the instances found so far, and the server logs a calendar rule expansion error. Rare
    rules written in a costly form (for example a daily event written as an every-minute rule) expand fewer instances.

  Advisories: https://github.com/inbuxa/inbuxa-server/security/advisories

  Downloads

  • SHA256SUMS
    184 B

    2026-10-29 14:52:34 +00:00
  • inbuxa-linux-amd64.tar.gz
    49 MiB

    2026-10-29 14:50:20 +00:00
  • inbuxa-linux-arm64.tar.gz
    46 MiB

    2026-10-29 14:52:34 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)