NetSight
IP …
high7.5

CVE-2026-27858

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.

Impact

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Affected products

VendorProductAffected versions
DovecotDovecot
before 2.4.3
Open-XchangeDovecot
before 2.3.22.1
from 3.0.0 before 3.0.5
from 3.1.0 before 3.1.4

Weakness classification

CWE-400CWE-770

References