CVE-2025-59032: Open-Xchange Dovecot denial of service in ManageSieve AUTHENTICATE

CVE-2025-59032 · Severity: high · CVSS 7.5 · Published 2026-03-27

A vulnerability has been identified in Dovecot, a widely used email server, specifically within its ManageSieve component which allows users to manage their email filtering rules. An attacker can send a specially crafted command to the server that causes the ManageSieve service to crash. This can be used to repeatedly disrupt the service, preventing legitimate users from managing their email settings and potentially impacting overall mail delivery operations.

Technologies: Dovecot, Open-Xchange Dovecot CE, Open-Xchange Dovecot Pro. Vendors: Dovecot, Open-Xchange.

Quick answers

Is CVE-2025-59032 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59032 being exploited in the wild.
How severe is CVE-2025-59032?
High severity, with a CVSS score of 7.5, published 27 March 2026.
Which products and versions are affected?
Open-Xchange Dovecot CE 2.4.0, 2.4.1, 2.4.3; Open-Xchange Dovecot Pro 2.3.0, 2.3.22.1, 3.0.2, 3.0.5, 3.1.0, 3.1.2, 3.1.3, 3.1.4.
Is there a fix for CVE-2025-59032?
A patch was published on 2026-05-04: Red Hat released security updates (RHSA-2026:13498) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59032 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-59032?
Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in the Dovecot ManageSieve service due to improper input validation. The root cause is located in the handling of the AUTHENTICATE command when a 'literal' is provided as the SASL initial response. A remote, unauthenticated attacker can exploit this by sending a malformed request to the ManageSieve port, triggering a service crash. This can be performed repeatedly to maintain a denial-of-service state. Red Hat and Open-Xchange have released patches to address this issue; users are advised to upgrade or restrict access to the ManageSieve port (typically 4190).

Affected products

  • Open-Xchange Dovecot Pro 2.3.0, 2.3.22.1, 3.0.2, 3.0.5, 3.1.0, 3.1.2, 3.1.3, 3.1.4
  • Open-Xchange Dovecot CE 2.4.0, 2.4.1, 2.4.3
  • Red Hat Enterprise Linux 8, 10

Timeline

  • 2026-03-27: advisory: Initial public release by Open-Xchange
  • 2026-05-04: patched: Red Hat released security updates (RHSA-2026:13498)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.