OX Dovecot Pro CVE-2025-59028

Exploitable remotely and unauthenticated (PR:N) against OX Dovecot Pro (≤3.1.0 and ≤2.4.0) wherever the login service accepts SASL authentication - no credentials or user interaction needed. The concrete prerequisite for widespread impact is that login processes run with concurrency enabled (multiple authentications per login process), which is the normal/default posture on large deployments; the vendor's alternative mitigation is to disable login-process concurrency, explicitly noted as carrying a heavy performance penalty on large deployments. The limiting factor is impact scope only: the flaw yields service disruption (failed concurrent logins) with no data exposure or code execution, so realistic risk is restricted to availability of the authentication/login service on internet-facing or otherwise reachable mail servers.

Signals are consistent and point to a genuine but availability-only concern rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) describes a clean remote, unauthenticated, low-complexity denial of service with no confidentiality or integrity impact. SSVC reinforces this: Exploitation=none (no observed exploitation), Automatable=yes (the trigger is a trivially scriptable malformed SASL string), Technical Impact=partial (service disruption, not full compromise). EPSS is low at 0.09% (26th percentile), and there is no CISA KEV listing and no public exploit - status is 'no public exploit identified at time of analysis.' The one signal tension is Automatable=yes combined with an unauthenticated, easily-reproduced trigger, which means that IF exploitation begins it could scale quickly, even though current exploitation probability is low. Net: this is a real patch-worthy issue for internet-facing mail infrastructure (the DoS breaks concurrent logins across all active sessions, not just the attacker's), but it is not a confidentiality/integrity threat and is not a high-real-risk, drop-everything item. Note the input Tags label this 'Information Disclosure,' which directly contradicts the vector (C:N/I:N, A:H) - this is a denial-of-service flaw and the tag is wrong.

An unauthenticated attacker connects to the IMAP/POP3/SMTP-submission service exposed by OX Dovecot Pro and initiates a SASL authentication exchange, sending deliberately malformed (invalid base64) SASL data. This disconnects the login process from the auth server, causing all in-flight authentication sessions handled by that concurrent login process to fail, denying login service to legitimate users. No public exploit code is known, but the trigger is trivial to script and requires no credentials or user interaction.