Version publiée le 01/10/2026
Changelog published on October 1st 2026
Security
- (Critical): Whitelist of columns for sorting emails and conversations.
- (High): Disabling external entities and DTDs in XML parsers (DAV,
DOMUtils).
- (Critical): related settings and domain-based isolation for scheduled jobs.
- (Medium): removal of the
BM* identity headers sent by the client.
- (Hardening): related settings for file sharing and password expiry.
Others
- Upgrades:
- nginx 1.30.1, fixes the following CVEs:
- CVE-2026-42926
- CVE-2026-42945
- CVE-2026-42946
- CVE-2026-42934
- CVE-2026-40460
- CVE-2026-40701
- CVE-2026-27654
- CVE-2026-27784
- CVE-2026-32647
- CVE-2026-27651
- CVE-2026-28753
- CVE-2026-28755
- CVE-2026-1642
- CVE-2025-23419
- CVE-2024-7347
- CVE-2024-32760
- CVE-2024-31079
- CVE-2024-35200
- CVE-2024-34161
- CVE-2024-24989
- CVE-2024-24990
- PostgreSQL 17.10
- OpenJDK 25.0.3+9