26.2 Snapshot 7 (known as 26.2-snapshot-7 in the launcher) is the seventh snapshot for Java Edition 26.2, released on May 12, 2026, which adds new soundtracks, a new music disc, peer-to-peer connectivity, the friends list, and a new menu panorama.
Full changelog: https://minecraft.wiki/Java_Edition_26.2-snapshot-7
There are experimental features in 2.4, one is enabled with --enable-experimental-mail-utf8, and another with --enable-experimental-imap4rev2, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config.
Critical bug fixes
CVE-2026-27851: lib-var-expand: Safe filter marks all following pipelines safe.
CVE-2026-33603: auth: CRAM-SHA-*-PLUS channel binding could be faked.
MITM attacker with a certificate trusted by the client could have
bypassed the requirement for channel binding.
CVE-2026-40020: IMAP folders can be shared-spammed to everyone.
CVE-2026-42006: An attacker can cause uncontrolled memory usage with
excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete.
Changes
indexer-worker, quota-status, script-login, program-client-local: Root
privileges are now dropped permanently before serving requests.
indexer-worker: Default restart_request_count changed to 1 to work
correctly after permanent root privilege drop.
lmtp: Add back service_extra_groups=$SET:default_internal_group that was
incorrectly removed in v2.4.3.
master: inet_listener_reuse_port has been replaced by service_reuse_port.
The new setting properly pre-creates all listener sockets at startup and
assigns one unique socket per process. Using this allows evenly distributing
incoming connections to login processes. See https://doc.dovecot.org/latest/core/config/service.html#service_reuse_port
for details.
Bug fixes
auth: Fix LDAP escaping of 0x13 control character.
auth: Use timing-safe comparison for certificate and public key fingerprints.
fts: Don't send request to Tika if there is no body text.
fts: Fix address header indexing for RFC 2047 encoded-words.
fts: tika, fts-solr: Fix use-after-free crash during DNS lookup.
imap: Fix assertion panic on invalid REPLACE 0 command.
lib-auth-client: Avoid "unknown id" errors for aborted auth requests.
lib-dcrypt: Fix potential crash if trying to access untrusted/corrupted keys.
lib-dcrypt: Improve error message if keys aren't in hex format as expected.
lib-index: Fix potential crash if fsck fails.
lib-ldap: Fix using OpenLDAP default CA when ssl_client_ca_dir/file is unset.
v2.4.3 regression.
lib-master, master: Fix behavior for services with client_limit>1 and
restart_request_count so that processes reaching restart_request_count are
no longer counted towards process_limit.
lib-master: Fix crash when reaching client_limit with restart_request_count>1.
lib-master: haproxy - Don't trust client certificate common name when
HAProxy reports verification failure.
lib-sasl: cram-md5 - Fix out of bounds memory read.
lib-sasl: oauth2 - Fix one byte out of bounds read.
Log in
