OX Dovecot CVE-2026-52681

Valid authenticated mail account credentials on the target OX Dovecot server are mandatory (CVSS PR:L confirms low-privilege authentication is required; no unauthenticated path exists). The Sieve filtering subsystem must be enabled and a per-user CPU limit must be configured - without an enforced CPU cap, the accounting-reset mechanism has no security boundary to bypass. The attacker must have the ability to upload, activate, delete, and rename Sieve scripts, which is standard capability for any mail user with Sieve access. Limiting factors: authentication cannot be bypassed (PR:L is a hard prerequisite); only availability is impacted at a low level (A:L - service degradation, not complete outage); confidentiality and integrity are entirely unaffected; and the vendor rates attack complexity as High (AC:H), suggesting additional timing, rate, or environmental conditions may apply that are not fully described in available data.

The vendor-reported CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) scores this at 3.1, reflecting a low-severity, authenticated, partial-availability impact. Confidentiality and integrity are entirely unaffected. The AC:H rating implies the vendor considers the exploitation conditions non-trivial, though the described mechanism - repeatedly changing the active script - appears mechanically straightforward for any authenticated mail user with Sieve access, and the rationale for AC:H is not explained in available data; this metric should be verified with the vendor advisory. No EPSS score was provided, no CISA KEV listing exists, and no public exploit code is known, making this a low-urgency finding in most environments. Real-world risk is highest in multi-tenant mail hosting scenarios where shared CPU and disk resources are pooled - a malicious or compromised mail account could degrade delivery for co-located tenants. Single-tenant deployments face a much narrower blast radius. The input tags this as 'Authentication Bypass,' which is a mislabeling; the vulnerability is a resource-limit accounting bypass, not a bypass of authentication itself.

An authenticated mail user uploads a computationally expensive Sieve script and sets it active, then immediately replaces it with a new script - resetting the CPU accounting counter to zero with each swap - looping this pattern to consume CPU indefinitely beyond the configured limit. Concurrently, each deleted or renamed intermediate script leaves a compiled file on disk, accumulating storage proportional to the iteration rate. Sustained over minutes or hours, this degrades Sieve processing throughput and disk availability for all other users sharing the server.