OX Dovecot Pro EUVD-2026-29470

The vulnerability requires an authenticated user account with Sieve script management capability, which is the default permission set for most mail users in OX Dovecot Pro. The specific condition is the ability to upload or place a Sieve script that matches a particular syntax or logic pattern that triggers the CPU limit bypass - the exact trigger is not disclosed in the advisory, but attackers can derive it through reverse engineering or collaborative disclosure. Exploitation via ManageSieve requires the service to be network-accessible (standard on port 4190); exploitation via local placement requires file system access to the Sieve script directories. The vulnerability is NOT triggered by default Sieve scripts or standard mail filtering operations - it requires attacker-controlled script content. Limiting factors: authentication is required (PR:L), and the attack is not fully automatic without understanding the specific script syntax that triggers the bypass; exploitation does not require user interaction or script execution by other users, only server-side message processing.

CVSS 5.3 with AV:N/AC:H/PR:L indicates network-accessible denial of service requiring low privilege and medium attack complexity, resulting in high availability impact. The attack vector (network) is realistic for mail server environments where ManageSieve is commonly exposed. The medium complexity suggests the attacker must craft specific Sieve syntax to trigger the bypass, but no technical barriers prevent this once understood. The low-privilege requirement is significant - any mail user can potentially exploit this, making organizational risk depend heavily on user trust and mail access control policies. No EPSS score or CISA KEV status provided, limiting confidence in real-world exploitation prevalence. The 130x CPU limit bypass suggests a calculated amplification factor rather than a complete parsing failure, indicating this is likely a subtle logic flaw rather than an obvious crash. The absence of public exploits combined with the authentication requirement suggests this is currently a low-visibility risk requiring internal awareness among sysadmins, but the network accessibility and ease of trigger (upload a script) mean risk will increase upon public disclosure or researcher documentation. This is genuinely a moderate-priority fix for production mail servers, not a low-risk high-CVSS artifact.

A low-privilege mail user with Sieve script management access (standard feature in most mail clients) uploads a specially crafted Sieve script via ManageSieve protocol that triggers the CPU limit bypass condition. The script executes on the mail server during message filtering, consuming 130 times the configured CPU time budget and degrading performance for all users on that server. Repeated uploads of such scripts or targeting of high-volume message processing can render the mail service slow or unresponsive. Alternatively, an attacker with local file system access directly places the malicious Sieve script in the script storage directory, bypassing ManageSieve authentication entirely.