EUVD-2026-67678
GHSA-x4gp-83hc-j86g
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Repeatedly cycling active scripts requires no race condition or special timing, warranting AC:L over vendor AC:H; valid credentials (PR:L) remain mandatory; only availability is affected.
Primary rating from Vendor (OX).
CVSS VectorVendor: OX
Lifecycle Timeline
2DescriptionCVE.org
Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. Both can cause degradation of service for mail delivery. Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version. No publicly available exploits are known.
AnalysisAI
Authenticated Sieve script manipulation in OX Dovecot Pro and CE allows low-privileged mail users to bypass configured per-user CPU resource limits and accumulate orphaned compiled script files on disk. By repeatedly switching the active Sieve script, an attacker resets the CPU accounting stored in each compiled artifact, circumventing the server-enforced cap indefinitely; separately, deleted or renamed scripts leave compiled files behind, causing unbounded disk growth. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Valid authenticated mail account credentials on the target OX Dovecot server are mandatory (CVSS PR:L confirms low-privilege authentication is required; no unauthenticated path exists). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-reported CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) scores this at 3.1, reflecting a low-severity, authenticated, partial-availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to the non-vulnerable version of OX Dovecot Pro or OX Dovecot CE as specified in the vendor CSAF advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json; no exact patched version number was independently confirmed from available data, so the advisory must be consulted directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ox Dovecot Pro
View allAuthentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU
ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh
SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote att
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today