5.9
Medium
CVE-2026-40019 An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin…
Description
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OX Dovecot CE 2.4 | 2.4.3 → < 2.4.5 | 2.4.5 |
Other CVEs of OX Dovecot CE
The 25 CVEs of OX Dovecot CE →
CVE-2026-73209
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust…
6.5
Medium
CVE-2026-73208
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token…
7.4
High
CVE-2026-52687
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression…
6.5
Medium
CVE-2026-52681
Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the…
3.1
Low