Skip to main content

Ox Dovecot Pro EUVDEUVD-2025-209092

| CVE-2025-59032 HIGH
Improper Input Validation (CWE-20)
2026-03-27 OX GHSA-w2gj-cmfm-c4j4
Denial Of Service Ox Dovecot Pro Open Xchange Gmbh
7.5
CVSS 3.1 · Vendor: OX
View

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Impact

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates this is a network-accessible vulnerability requiring low attack complexity with no authentication or user interaction required, resulting in high availability impact. While the 7.5 CVSS score reflects significant severity, the real-world risk is moderated by several factors: the attack only impacts availability (no confidentiality or integrity compromise), ManageSieve is a specialized service not universally deployed, and the vulnerability requires the service to be network-accessible. No public exploit code exists and no CISA KEV listing indicates active exploitation. Organizations not using ManageSieve for Sieve script management face zero risk. For affected deployments, the primary concern is service disruption rather than data compromise, and simple access controls (firewall restrictions to trusted networks) provide effective mitigation until patching.
Exploit ScenarioDerived

An unauthenticated remote attacker identifies an internet-facing OX Dovecot Pro server with ManageSieve enabled on port 4190. The attacker crafts a malicious AUTHENTICATE command containing a literal as the SASL initial response and sends it to the service, causing an immediate crash. By automating this attack to repeatedly send malformed commands as the service restarts, the attacker maintains a persistent denial of service condition, preventing legitimate users from accessing their mail filtering configuration and potentially disrupting automated mail processing rules.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 27, 2026

OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using literal format, enabling unauthenticated remote attackers to repeatedly crash the service and deny availability to legitimate users (CVSS 7.5, High availability impact). The vulnerability affects OX Dovecot Pro installations with ManageSieve enabled. No public exploit identified at time of analysis, and EPSS data was not provided in available intelligence.

RemediationAI

Upgrade to the fixed version of OX Dovecot Pro as specified in the vendor security advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json. Until patching is possible, implement network-level access controls to restrict ManageSieve port access (typically TCP 4190) to only trusted IP ranges or authenticated VPN connections. Organizations not requiring server-side Sieve script management capabilities should disable the ManageSieve service entirely in the Dovecot configuration (set protocols to exclude managesieve). The vendor advisory references a patch available per the CSAF document, though the exact fixed version number was not included in the analyzed intelligence feed.

Affected VersionsENISA

OX Dovecot Pro 0 ≤2.4.0
OX Dovecot Pro 0 ≤3.1.0

Affected Packages

euvd ox_dovecot_pro no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the ManageSieve protocol implementation within OX Dovecot Pro (CPE cpe:2.3:a:open-xchange_gmbh:ox_dovecot_pro). ManageSieve is an IETF protocol (RFC 5804) that allows users to manage server-side mail filtering rules (Sieve scripts). The flaw is classified as CWE-20 (Improper Input Validation), indicating the service fails to properly validate or handle literal syntax when used as a SASL (Simple Authentication and Security Layer) initial response during the AUTHENTICATE command sequence. This input validation failure causes the ManageSieve process to crash, requiring restart and disrupting service availability for all users attempting to manage their mail filters.

Know when Ox Dovecot Pro gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (OX) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu MEDIUM
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 13:49 nvd
Patch available
CVE Published
Mar 27, 2026 - 08:10 nvd
HIGH 7.5

DescriptionCVE.org

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.

Executive ViewAI

Why It Matters

OX Dovecot Pro's ManageSieve service contains a denial-of-service vulnerability that allows unauthenticated remote attackers to repeatedly crash the service through malformed SASL authentication requests, disrupting email filter management for all users relying on this capability. Organizations running Dovecot Pro with ManageSieve enabled face availability risk without an available patch, requiring immediate mitigation to protect service continuity.

Business Impact: High
Compensating Controls

Disable ManageSieve service on Dovecot Pro instances where sieve script management is not operationally required. Restrict network access to ManageSieve port (4190) via firewall rules, allowing only connections from trusted administrative networks or jump hosts. Implement rate-limiting and connection throttling on the ManageSieve port to slow denial-of-service attempts. Deploy IDS/IPS signatures targeting malformed SASL AUTHENTICATE commands with literal format encoding. Monitor Dovecot Pro service logs for repeated crash events and configure alerting on unexpected service restarts. Consider network segmentation to isolate ManageSieve services from general user access.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in Dovecot Authentication and DoS Vulnerabilities

View all 8
CVE-2026-27858 HIGH
7.5
CVE-2026-0394 MEDIUM
5.3
CVE-2026-27855 MEDIUM
5.9
CVE-2026-27859 MEDIUM
5.3
CVE-2026-27860 MEDIUM POC
5.3
CVE-2026-24031 HIGH
8.2
CVE-2026-27856 MEDIUM
5.9

More in Ox Dovecot Pro

View all
CVE-2026-42007 CRITICAL
9.1 Aug 28

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
CVE-2026-27851 CRITICAL
9.1 May 12

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2025-59028 HIGH
7.5 Mar 27

Unauthenticated remote attackers can disrupt authentication on OX Dovecot Pro servers by sending malformed base64 SASL d
CVE-2026-27857 HIGH
7.5 Mar 27

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-73208 HIGH
7.4 Aug 28

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
dovecot
Release Status Version
trusty needed -
xenial needed -
bionic needed -
focal needed -
jammy needed -
noble needed -
questing needed -
upstream released 2.4.3

Debian

dovecot
Release Status Fixed Version Urgency
bullseye vulnerable 1:2.3.13+dfsg1-2+deb11u1 -
bullseye (security) vulnerable 1:2.3.13+dfsg1-2+deb11u2 -
bookworm, bookworm (security) vulnerable 1:2.3.19.1+dfsg1-2.1+deb12u1 -
trixie vulnerable 1:2.4.1+dfsg1-6+deb13u3 -
trixie (security) vulnerable 1:2.4.1+dfsg1-6+deb13u1 -
forky, sid vulnerable 1:2.4.2+dfsg1-4 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-59032 ADVISORY https://ubuntu.com/security/notices/USN-8136-1 ADVISORY https://vuldb.com/?id.353850 REF https://access.redhat.com/errata/RHSA-2026:13498 REF https://access.redhat.com/errata/RHSA-2026:13830 REF https://access.redhat.com/errata/RHSA-2026:13857 REF https://access.redhat.com/errata/RHSA-2026:17602 REF https://access.redhat.com/errata/RHSA-2026:17625 REF https://access.redhat.com/errata/RHSA-2026:17626 REF https://access.redhat.com/errata/RHSA-2026:17628 REF https://access.redhat.com/errata/RHSA-2026:17630 REF https://access.redhat.com/errata/RHSA-2026:18053 REF https://access.redhat.com/errata/RHSA-2026:19149 REF https://access.redhat.com/errata/RHSA-2026:19364 REF https://access.redhat.com/errata/RHSA-2026:19453 REF https://access.redhat.com/errata/RHSA-2026:19455 REF https://access.redhat.com/errata/RHSA-2026:26564 REF https://access.redhat.com/security/cve/CVE-2025-59032 REF https://bugzilla.redhat.com/show_bug.cgi?id=2452172 REF https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59032.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy