Skip to main content

Ox Dovecot Pro CVE-2026-27858

| EUVDEUVD-2026-16569 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-03-27 OX
Denial Of Service Ox Dovecot Pro Open Xchange Gmbh
7.5
CVSS 3.1 · Vendor: OX
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect to managesieve server
  2. Delivery
    Send crafted pre-authentication message
  3. Exploit
    Trigger excessive memory allocation
  4. Execution
    Exhaust server resources
  5. Impact
    Crash managesieve-login process

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Remote unauthenticated attacker can send crafted messages to managesieve protocol before authentication occurs. Affects default managesieve-login installations accessible over the network. No victim interaction required; attacker repeatedly sends malicious messages to exhaust server memory and cause denial of service.
Impact

The CVSS 3.1 score of 7.5 reflects a high-severity availability impact with network-accessible attack vector (AV:N), low attack complexity (AC:L), and no authentication required (PR:N). The vulnerability enables straightforward denial of service but does not compromise confidentiality or integrity (C:N/I:N/A:H). Real-world risk is elevated for organizations exposing managesieve to untrusted networks, as the attack is automatable and requires no privileges or user interaction. However, no public exploit identified at time of analysis and no EPSS or KEV data provided suggests this is not yet widely targeted. The primary risk is service disruption rather than data breach, and the vulnerability can be mitigated through network access controls if patching is delayed. Organizations not using managesieve or those with restricted network access face minimal risk.
Exploit ScenarioDerived

An unauthenticated remote attacker sends specially crafted protocol messages to the managesieve-login service on port 4190 before completing authentication. The malformed messages trigger uncontrolled memory allocation, causing the managesieve-login process to crash due to resource exhaustion. By repeatedly sending these crafted messages, the attacker can prevent legitimate users from managing their Sieve mail filtering rules, achieving sustained denial of service against the managesieve functionality.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 27, 2026

OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attackers sending crafted messages. The vulnerability enables remote denial of service against the managesieve protocol without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), with a CVSS score of 7.5 (High severity). No public exploit identified at time of analysis, and the vendor has released a security advisory with remediation guidance.

RemediationAI

Install the fixed version of OX Dovecot Pro as specified in the vendor security advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json (exact patch version details available in the CSAF advisory). As an interim mitigation measure, restrict network access to the managesieve protocol (typically port 4190) using firewall rules or access control lists to limit exposure to trusted IP ranges only. Organizations not actively using Sieve script management should disable the managesieve service entirely until patching is completed. The advisory notes that no publicly available exploits are known, providing a reasonable window for controlled deployment of patches.

Affected VersionsENISA

OX Dovecot Pro 0 ≤2.3.0
OX Dovecot Pro 0 ≤3.1.0
OX Dovecot Pro 0 ≤2.4.0

Affected Packages

euvd ox_dovecot_pro no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability affects the managesieve protocol implementation in OX Dovecot Pro, identified by CPE cpe:2.3:a:open-xchange_gmbh:ox_dovecot_pro. Managesieve (RFC 5804) is a protocol for remotely managing Sieve mail filtering scripts on a mail server. The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), indicating the managesieve-login process fails to properly validate or limit memory allocation when processing specially crafted messages during the pre-authentication phase. This allows attackers to exhaust available memory resources before any authentication checks occur, making the service unavailable through repeated process crashes.

Know when Ox Dovecot Pro gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (OX) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu MEDIUM
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 13:49 nvd
Patch available
CVE Published
Mar 27, 2026 - 08:10 nvd
HIGH 7.5

DescriptionCVE.org

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Executive ViewAI

Why It Matters

OX Dovecot Pro's managesieve-login service is vulnerable to remote denial of service attacks that exhaust server memory and crash the process without requiring authentication. Organizations running this email management platform face service unavailability risks until a patch is available, potentially disrupting mail filtering and user access to sieve rules.

Business Impact: High
Compensating Controls

Segment managesieve protocol access at the network perimeter (firewall rules, WAF, or network ACLs) to restrict connections to known trusted administrative subnets; disable the managesieve-login service entirely if sieve rule management is not operationally required; implement rate-limiting on port 4190 to mitigate memory exhaustion triggered by rapid crafted message sequences; monitor Dovecot process memory usage and configure alerting for abnormal process crashes. No vendor-released patch identified at time of analysis; apply patch immediately when released by OX.

Threat Intelligence Overview

EPSS Score
0.0%
Top 85% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in Dovecot Authentication and DoS Vulnerabilities

View all 8
CVE-2025-59032 HIGH
7.5
CVE-2026-0394 MEDIUM
5.3
CVE-2026-27855 MEDIUM
5.9
CVE-2026-27859 MEDIUM
5.3
CVE-2026-27860 MEDIUM POC
5.3
CVE-2026-24031 HIGH
8.2
CVE-2026-27856 MEDIUM
5.9

More in Ox Dovecot Pro

View all
CVE-2026-42007 CRITICAL
9.1 Aug 28

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
CVE-2026-27851 CRITICAL
9.1 May 12

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2025-59028 HIGH
7.5 Mar 27

Unauthenticated remote attackers can disrupt authentication on OX Dovecot Pro servers by sending malformed base64 SASL d
CVE-2026-27857 HIGH
7.5 Mar 27

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-73208 HIGH
7.4 Aug 28

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
dovecot
Release Status Version
trusty needed -
xenial needed -
bionic needed -
focal needed -
jammy needed -
noble needed -
questing needed -
upstream released 2.4.3

Debian

dovecot
Release Status Fixed Version Urgency
bullseye vulnerable 1:2.3.13+dfsg1-2+deb11u1 -
bullseye (security) vulnerable 1:2.3.13+dfsg1-2+deb11u2 -
bookworm, bookworm (security) vulnerable 1:2.3.19.1+dfsg1-2.1+deb12u1 -
trixie vulnerable 1:2.4.1+dfsg1-6+deb13u3 -
trixie (security) vulnerable 1:2.4.1+dfsg1-6+deb13u1 -
forky, sid vulnerable 1:2.4.2+dfsg1-4 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-27858 ADVISORY https://ubuntu.com/security/notices/USN-8136-1 ADVISORY https://vuldb.com/?id.353847 REF https://access.redhat.com/errata/RHSA-2026:13498 REF https://access.redhat.com/errata/RHSA-2026:13830 REF https://access.redhat.com/errata/RHSA-2026:13857 REF https://access.redhat.com/errata/RHSA-2026:17602 REF https://access.redhat.com/errata/RHSA-2026:17625 REF https://access.redhat.com/errata/RHSA-2026:17626 REF https://access.redhat.com/errata/RHSA-2026:17628 REF https://access.redhat.com/errata/RHSA-2026:17630 REF https://access.redhat.com/errata/RHSA-2026:18053 REF https://access.redhat.com/errata/RHSA-2026:19149 REF https://access.redhat.com/errata/RHSA-2026:19364 REF https://access.redhat.com/errata/RHSA-2026:19453 REF https://access.redhat.com/errata/RHSA-2026:19455 REF https://access.redhat.com/errata/RHSA-2026:26564 REF https://access.redhat.com/security/cve/CVE-2026-27858 REF https://bugzilla.redhat.com/show_bug.cgi?id=2452175 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27858.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy