OX Dovecot CVE-2026-33605

Network connectivity to the ManageSieve service port (typically TCP 4190) is the only prerequisite - no authentication, no user interaction, and no special client software is required. The attack operates entirely in the pre-authentication phase. The critical limiting factor is deployment mode: in high-security mode (the default for CE community releases), each connection runs in an isolated process, so only the attacker's own connection terminates - repeated attacks cause no collateral disruption to other users. In high-performance mode (the default for Pro releases), multiple connections share a single managesieve-login process, so each crash evicts all co-resident authenticated sessions; this is the condition that makes repeated attacks an effective DoS. The vulnerability is scoped entirely to ManageSieve - IMAP, SMTP, and other Dovecot services are unaffected. Restricting ManageSieve port exposure to trusted networks is a complete preventive control.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the unauthenticated, low-complexity network attack path and high availability impact at the process level. However, real-world severity is strongly conditional on deployment mode: CE deployments in high-security mode experience only self-contained connection drops per attack, substantially limiting practical DoS impact and making the effective risk closer to medium for that population. Pro deployments in high-performance mode face process-wide connection eviction, translating the theoretical CVSS score more directly to operational disruption. No EPSS data was provided; absent a KEV listing and with no known public exploit code, widespread opportunistic exploitation is unlikely. The primary realistic risk is a targeted, low-effort DoS against organizations exposing ManageSieve externally on Pro installations. Restricting ManageSieve port access to trusted networks eliminates the attack surface entirely.

An attacker with network access to the ManageSieve port connects without authenticating and sends a small malformed command before the login handshake completes, causing the managesieve-login process to crash. On a Pro deployment in high-performance mode, this immediately disconnects all users sharing that process. The attacker repeats the connection and crash cycle at intervals, sustaining denial of service and preventing legitimate users from uploading or modifying Sieve mail filtering rules. No public exploit code is required - the primitive is a simple malformed protocol command.