Skip to main content

OX Dovecot Pro CVE-2026-40016

| EUVDEUVD-2026-29470 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-05-12 OX GHSA-m97m-74mq-mqc6
Denial Of Service Red Hat Suse Ox Dovecot Pro Open Xchange Gmbh
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
May 12, 2026 - 14:16 vuln.today
CVE Published
May 12, 2026 - 13:28 nvd
MEDIUM 5.3

DescriptionCVE.org

Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known.

AnalysisAI

OX Dovecot Pro allows authenticated users to upload malicious Sieve scripts via ManageSieve protocol or local access that bypass configured CPU time limits by up to 130 times, enabling denial of service through server performance degradation. The vulnerability requires low-privilege authenticated access and medium attack complexity, affecting availability without compromising confidentiality or integrity. No public exploit code has been identified at the time of analysis.

Technical ContextAI

OX Dovecot Pro implements Sieve script filtering with configurable CPU time limits to prevent resource exhaustion. The vulnerability exists in the Sieve script parser or execution engine, which fails to properly enforce CPU time constraints when processing specially crafted scripts. This is classified as CWE-400 (Uncontrolled Resource Consumption), indicating the product does not adequately limit computational resources consumed by user-supplied Sieve scripts. The ManageSieve protocol (RFC 5804) provides a standard interface for remote script management, and local script placement bypasses protocol-level safeguards entirely. The affected product is identified via CPE as OX Dovecot Pro from Open-Xchange GmbH across all versions.

RemediationAI

Install the fixed version of OX Dovecot Pro as released by Open-Xchange GmbH per their security advisory. If an immediate patch is unavailable, implement the following compensating controls: disable or restrict access to the ManageSieve protocol (RFC 5804) via network firewall rules, limiting script management to out-of-band administrative processes; remove or restrict file system permissions for direct Sieve script placement in the local script directories; and reduce the configured Sieve CPU time limit to account for the 130x amplification factor until patched (e.g., if limit is 10 seconds, temporarily reduce to 0.08 seconds, with side effect of rejecting legitimately complex scripts). Monitor Sieve execution logs and server CPU utilization for signs of resource exhaustion attacks. These workarounds degrade user functionality and are temporary - prioritize patching as the primary remediation.

More in Ox Dovecot Pro

View all
CVE-2026-42007 CRITICAL
9.1 Aug 28

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
CVE-2026-27851 CRITICAL
9.1 May 12

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
CVE-2026-24031 HIGH
8.2 Mar 27

Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
CVE-2026-27860 LOW POC
3.7 Mar 27

Open-Xchange Dovecot Pro contains an LDAP filter injection vulnerability in its authentication module that allows remote
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2025-59032 HIGH
7.5 Mar 27

OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
CVE-2026-27858 HIGH
7.5 Mar 27

OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
CVE-2026-27857 HIGH
7.5 Mar 27

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-73208 HIGH
7.4 Aug 28

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

CVE-2026-40016 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy