woodfairy
0a0686ef19
The current nginx, clamd and postfix images ship a brotli decoder in the affected range 1.0.3 - 1.2.0 (CVE-2026-111497, CVSS 9.8, listed in CISA KEV): - nginx:1.30.6-2 brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0) - clamd:1.4.6-1 brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0) - postfix:3.10.12-1 libbrotli1 1.1.0-2+b7 (fixed in trixie-security: 1.1.0-2+deb13u1, DSA-6582-1) All other mailcow images already contain a fixed version. clamd and postfix only need a rebuild, which pulls the fixed packages. The postfix rebuild also picks up Debian's postfix 3.10.13, hence the new tag postfix:3.10.13-1. The nginx image never upgraded the packages of its base image, so it only got fixes when nginx:<version>-alpine was republished. It now runs apk upgrade like clamd and acme do.
mailcow: dockerized - 🐮 + 🐋 = 💕
Want to support mailcow?
Please consider a support contract with Servercow to support further development. We support you while you support us. :)
You can also get a SAL which is a one-time payment with no liabilities or returning fees.
Or just spread the word: moo.
Many thanks to our GitHub Sponsors ❤️
A big thank you to everyone supporting us on GitHub Sponsors—your contributions mean the world to us! Special thanks to the following amazing supporters:
100$/Month Sponsors
50$/Month Sponsors
Info, documentation and support
Please see the official documentation for installation and support instructions. 🐄
🐛 If you found a critical security issue, please mail us to info at servercow.de.
Cowmunity
Telegram mailcow Off-Topic channel
Telegram desktop clients are available for multiple platforms. You can search the groups history for keywords.
Misc
Important: mailcow makes use of various open-source software. Please assure you agree with their license before using mailcow. Any part of mailcow itself is released under GNU General Public License, Version 3.
mailcow is a registered word mark of The Infrastructure Company GmbH, Parkstr. 42, 47877 Willich, Germany.
The project is managed and maintained by The Infrastructure Company GmbH.
Originated from @andryyy (André)