diff --git a/dovecot-2.3-tokensize.patch b/dovecot-2.3-tokensize.patch
new file mode 100644
index 0000000..d67e47f
--- /dev/null
+++ b/dovecot-2.3-tokensize.patch
@@ -0,0 +1,12 @@
+diff -up dovecot-2.3.21/src/login-common/client-common.h.tokensize dovecot-2.3.21/src/login-common/client-common.h
+--- dovecot-2.3.21/src/login-common/client-common.h.tokensize
++++ dovecot-2.3.21/src/login-common/client-common.h
+@@ -26,7 +26,7 @@
+ #define LOGIN_MAX_OUTBUF_SIZE 4096
+
+ /* Max. length of SASL authentication buffer. */
+-#define LOGIN_MAX_AUTH_BUF_SIZE 8192
++#define LOGIN_MAX_AUTH_BUF_SIZE 65536
+
+ /* Disconnect client after this many milliseconds if it hasn't managed
+    to log in yet. */
diff --git a/dovecot.spec b/dovecot.spec
index 76b315d..7ad38d3 100644
--- a/dovecot.spec
+++ b/dovecot.spec
@@ -6,7 +6,7 @@ Name: dovecot
 Epoch: 1
 Version: 2.3.16
 %global prever %{nil}
-Release: 19%{?dist}
+Release: 20%{?dist}
 #dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2
 License: MIT and LGPLv2
 
@@ -97,6 +97,9 @@ Patch36: dovecot-2.3-cve-2026-27857p5of5.patch
 # https://github.com/dovecot/core/commit/da1438c76b797f055d4ad7f0eaa17e5e29ca31ee
 Patch37: dovecot-2.3-cve-2026-42006.patch
 
+# sent upstream, RHEL-213588
+Patch38: dovecot-2.3-tokensize.patch
+
 BuildRequires: gcc, gcc-c++, openssl-devel, pam-devel, zlib-devel, bzip2-devel, libcap-devel
 BuildRequires: libtool, autoconf, automake, pkgconfig
 BuildRequires: sqlite-devel
@@ -212,6 +215,7 @@ mv dovecot-2.3-pigeonhole-%{pigeonholever} dovecot-pigeonhole
 %patch -P 35 -p1 -b .cve-2026-27857p4of5
 %patch -P 36 -p1 -b .cve-2026-27857p5of5
 %patch -P 37 -p1 -b .cve-2026-42006
+%patch -P 38 -p1 -b .tokensize
 cp run-test-valgrind.supp dovecot-pigeonhole/
 # valgrind would fail with shell wrapper
 echo "testsuite" >dovecot-pigeonhole/run-test-valgrind.exclude
@@ -556,6 +560,9 @@ make check
 %{_libdir}/%{name}/dict/libdriver_pgsql.so
 
 %changelog
+* Mon Aug 03 2026 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-20
+- increase SASL auth buffer size for large Kerberos tickets (RHEL-213588)
+
 * Fri Jun 26 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1:2.3.16-19
 - fix CVE-2026-42006: IMAP parser list_count_limit bypass via open
   parentheses (RHEL-188479)