CVE-2026-27858
Memory Exhaustion Vulnerability in managesieve Causes Service Crash
Publication date: 2026-03-27
Last updated on: 2026-04-30
Assigner: Open-Xchange
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dovecot | dovecot | to 2.4.3 (exc) |
| open-xchange | dovecot | From 3.0.0 (inc) to 3.0.5 (exc) |
| open-xchange | dovecot | From 3.1.0 (inc) to 3.1.4 (exc) |
| open-xchange | dovecot | to 2.3.22.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves an attacker sending a specially crafted message to the managesieve service before authentication. This causes managesieve to allocate a large amount of memory.
As a result, the managesieve-login process can be repeatedly crashed, making the managesieve service unavailable.
How can this vulnerability impact me? :
The main impact of this vulnerability is a denial of service (DoS) condition.
- Attackers can repeatedly crash the managesieve-login process, causing the service to become unavailable.
- This can disrupt email filtering or management services that rely on managesieve.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should protect access to the managesieve protocol or install a fixed version of the software.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to cause a denial of service by crashing the managesieve-login process, leading to unavailability of the managesieve service.
There is no indication from the provided information that this vulnerability impacts confidentiality or integrity of data, only availability.
Since common standards and regulations like GDPR and HIPAA emphasize the availability, integrity, and confidentiality of data, this vulnerability primarily affects the availability aspect.
Organizations relying on managesieve for email management should consider that denial of service could impact compliance related to service availability requirements.
No direct information is provided about specific compliance impacts or mitigation steps related to these standards.