Skip to main content

OX Dovecot CE CVE-2026-40019

| EUVDEUVD-2026-67668 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-08-28 OX GHSA-c3mr-h4j4-h26r
Denial Of Service Ox Dovecot Ce
5.9
CVSS 3.1 · Vendor: OX
Share

Severity by source

Vendor (OX) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Attack occurs at unauthenticated login phase over network; AC:H reflects precision crafting of truncated argument; sole impact is CPU exhaustion with no confidentiality or integrity effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Aug 28, 2026 - 13:17 EUVD
Analysis Generated
Aug 28, 2026 - 12:13 vuln.today

DescriptionCVE.org

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.

AnalysisAI

CPU exhaustion via infinite loop in OX Dovecot CE's ManageSieve login handler allows unauthenticated remote attackers to deny Sieve script management and potentially degrade the entire mail server. The flaw is triggered at the pre-authentication stage, requiring only network access to the ManageSieve port; repeated connections can saturate all available CPU cores. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The ManageSieve protocol service must be network-reachable from the attacker - typically TCP port 4190 exposed to an untrusted network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 5.9 (Medium) is consistent with the attack profile: AV:N and PR:N confirm remote unauthenticated access, while AC:H acknowledges that triggering the infinite loop requires a precisely truncated quoted argument - not a trivial or script-kiddie-level attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary fix is to update OX Dovecot CE to the patched version referenced in the vendor advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json; the exact fixed version number is not independently confirmed from the available data and must be obtained from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ox Dovecot Ce

View all
CVE-2026-42007 CRITICAL
9.1 Aug 28

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-73208 HIGH
7.4 Aug 28

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh
CVE-2026-73209 MEDIUM
6.5 Aug 28

Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote att
CVE-2026-52687 MEDIUM
6.5 Aug 28

IMAP compression in OX Dovecot Pro and OX Dovecot CE allows any authenticated user to exhaust the memory of the imap-log
CVE-2026-40017 MEDIUM
6.5 Aug 28

OX Dovecot Pro and OX Dovecot CE are susceptible to a hash-collision denial-of-service attack where an attacker who can

CVE-2026-40014 MEDIUM
6.5 Aug 28

CPU exhaustion in OX Dovecot's IMAP THREAD command allows a remote unauthenticated attacker to degrade or deny IMAP serv
CVE-2026-33604 MEDIUM
5.9 Aug 28

SMTP smuggling in Open-Xchange's OX Dovecot Pro and Community Edition allows an unauthenticated attacker to inject forge
CVE-2026-40205 MEDIUM
5.9 Aug 28

OAuth2 multi-scope enforcement bypass in OX Dovecot Pro and CE allows an attacker holding a partial-scope OAuth2 token t

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected

Share

CVE-2026-40019 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy