OX Dovecot CE CVE-2026-40019

The ManageSieve protocol service must be network-reachable from the attacker - typically TCP port 4190 exposed to an untrusted network. The vulnerability is triggered at the login stage before any authentication is completed, so no credentials are required. The CVSS AC:H metric indicates that the truncated quoted argument must be crafted with precision; generic scanning tools are unlikely to trigger the condition accidentally. Exploitation is limited by: (1) AC:H crafting requirement, which raises the bar above opportunistic attack; (2) any firewall or network policy restricting ManageSieve to trusted clients eliminates the attack vector entirely; (3) organizations not running the ManageSieve service are unaffected. There is no dependency on a non-default Dovecot configuration - the ManageSieve service itself is the required condition.

The vendor-assigned CVSS 5.9 (Medium) is consistent with the attack profile: AV:N and PR:N confirm remote unauthenticated access, while AC:H acknowledges that triggering the infinite loop requires a precisely truncated quoted argument - not a trivial or script-kiddie-level attack. Availability impact is High (A:H) because CPU exhaustion from repeated connections can degrade the entire host, not just the ManageSieve daemon. Confidentiality and Integrity are unaffected (C:N/I:N), so data exfiltration or modification are not concerns. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, meaning there is no confirmed evidence of active exploitation. The absence of public exploit code further reduces near-term risk. Real-world priority is moderate: organizations that expose ManageSieve to untrusted networks face meaningful denial-of-service risk; those that restrict port 4190 to internal networks are effectively not exposed. The AC:H rating is the primary mitigating factor against mass exploitation.

An attacker with network access to TCP port 4190 sends a ManageSieve login command containing a deliberately truncated quoted string argument. The Dovecot ManageSieve parser enters an infinite loop processing the malformed token, consuming a full CPU core. By opening multiple simultaneous connections and repeating the malformed login, the attacker saturates all available CPU on the server, degrading or collapsing mail services for legitimate users.