← CVE Intelligence

CVE-2026-27858

Open-Xchange GmbH / OX Dovecot Pro PUBLISHED

Description (CNA)

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Affected (CNA)

Vendor / productVersions
Open-Xchange GmbH / OX Dovecot Proaffected 0 through 2.3.0; affected 0 through 3.1.0; affected 0 through 2.4.0

CWE

CWE-400

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in dovecot. An unauthenticated and remote attacker can send a crafted message that causes managesieve to allocate an excessive amount of memory, forcing managesieve-login to be unavailable by repeatedly crashing the process, resulting in a denial of service.