Description
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
Affected products
dovecot: dovecot; open-xchange: dovecot
References10
- documentation.open-xchange.com/dovecot/security/advisories/csaf… Vendor Advisory
- access.redhat.com/errata/RHSA-2026:13498
- access.redhat.com/errata/RHSA-2026:13830
- access.redhat.com/errata/RHSA-2026:13857
- access.redhat.com/errata/RHSA-2026:17602
- access.redhat.com/errata/RHSA-2026:17625
- access.redhat.com/errata/RHSA-2026:17626
- access.redhat.com/errata/RHSA-2026:17628
- access.redhat.com/errata/RHSA-2026:17630
- access.redhat.com/errata/RHSA-2026:18053
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 1% percentile: 57 · as of 12 November 2026
- CWE
- CWE-400CWE-770
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.