CVE-2025-59032

Modified Modified - Updated After Analysis

ManageSieve AUTHENTICATE Crash via SASL Literal Causes DoS

Publication date: 2026-03-27

Last updated on: 2026-06-30

Assigner: Open-Xchange

Description

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-27

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-03-27

EPSS Evaluated

2026-07-05

NVD

CVE-2025-59032

EUVD

EUVD-2025-209092

Affected Vendors & Products

Vendor	Product	Version / Range
dovecot	dovecot	to 2.4.3 (exc)
open-xchange	dovecot	to 3.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-229	The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the ManageSieve service when the AUTHENTICATE command is used with a literal as the SASL initial response. This causes the ManageSieve service to crash repeatedly.

As a result, the service becomes unavailable to other users.

Impact Analysis

The primary impact of this vulnerability is a denial of service condition where the ManageSieve service crashes repeatedly and becomes unavailable to users.

This can disrupt normal operations that rely on the ManageSieve service.

Mitigation Strategies

To mitigate this vulnerability, you should control access to the ManageSieve port or disable the service if it is not needed.

Alternatively, upgrading to a fixed version of the software is recommended.

Detection Guidance

There are no publicly available exploits or specific detection commands provided for this vulnerability.

To detect attempts to exploit this vulnerability, monitoring the ManageSieve service for crashes or repeated connection failures on its port may help identify potential attacks.

Additionally, controlling access to the ManageSieve port or disabling the service if not needed are recommended mitigation steps.

Compliance Impact

The vulnerability causes the ManageSieve AUTHENTICATE command to crash the service, leading to denial of service (availability impact). However, there is no indication that it affects confidentiality or integrity of data.

Since the vulnerability impacts availability but not confidentiality or integrity, its direct effect on compliance with standards like GDPR or HIPAA—which emphasize protection of personal data confidentiality and integrity—is limited.

Nevertheless, availability is a component of these regulations, so repeated service crashes could potentially affect compliance if critical services are disrupted and not properly managed or mitigated.

Mitigation recommendations include controlling access to the ManageSieve port, disabling the service if not needed, or upgrading to a fixed version, which can help maintain compliance by ensuring service availability.

Hi! I’m here to help you understand CVE-2025-59032. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70