# CVE-2026-27858: Open-Xchange Dovecot denial of service in ManageSieve

Source: https://junglewise.ai/threats/cve-2026-27858-open-xchange-dovecot-denial-of-service-in-managesieve  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-27858 · Severity: high · CVSS 7.5 · Published 2026-03-27

A vulnerability in the Dovecot email server's ManageSieve component allows an unauthenticated attacker to crash the service. By sending a specially crafted message, an attacker can force the system to exhaust its memory, leading to a denial of service. This prevents legitimate users from managing their email filters and can impact overall mail server availability.

Technologies: [Dovecot](https://junglewise.ai/threats/technologies/dovecot), [Open-Xchange Dovecot CE](https://junglewise.ai/threats/technologies/dovecot-ce), [Open-Xchange Dovecot Pro](https://junglewise.ai/threats/technologies/dovecot-pro). Vendors: [Dovecot](https://junglewise.ai/threats/vendors/dovecot), [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2026-27858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27858 being exploited in the wild.

**How severe is CVE-2026-27858?** High severity, with a CVSS score of 7.5, published 27 March 2026.

**Which products and versions are affected?** Open-Xchange Dovecot CE 2.4.0, 2.4.1, 2.4.3; Open-Xchange Dovecot Pro 2.3.0, 2.3.22.1, 3.0.2, 3.0.5, 3.1.0, 3.1.2, 3.1.3, 3.1.4.

**Is there a fix for CVE-2026-27858?** A patch was published on 2026-05-04: Red Hat released security updates for RHEL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27858 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27858?** Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as uncontrolled resource consumption (CWE-400/CWE-770) within the ManageSieve component of Dovecot. An attacker can trigger the flaw by sending a specifically crafted message during the pre-authentication phase of a connection. This causes the managesieve-login process to allocate an excessive amount of memory, leading to a crash. Repeated exploitation can result in a sustained denial of service (DoS) for the ManageSieve protocol. Patches are available from Open-Xchange and Red Hat (e.g., RHSA-2026:13498).

## Affected products

- Open-Xchange Dovecot Pro 2.3.0, 2.3.22.1, 3.0.2, 3.0.5, 3.1.0, 3.1.2, 3.1.3, 3.1.4
- Open-Xchange Dovecot CE 2.4.0, 2.4.1, 2.4.3
- Red Hat Enterprise Linux 8, 10, 10.2

## Timeline

- 2026-03-27: advisory: Initial release of OXDC-ADV-2026-0001
- 2026-05-04: patched: Red Hat released security updates for RHEL 10

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json)
- [https://access.redhat.com/errata/RHSA-2026:13498](https://access.redhat.com/errata/RHSA-2026:13498)
- [https://access.redhat.com/errata/RHSA-2026:13830](https://access.redhat.com/errata/RHSA-2026:13830)
- [https://access.redhat.com/errata/RHSA-2026:13857](https://access.redhat.com/errata/RHSA-2026:13857)
- [https://access.redhat.com/errata/RHSA-2026:17602](https://access.redhat.com/errata/RHSA-2026:17602)
- [https://access.redhat.com/errata/RHSA-2026:17625](https://access.redhat.com/errata/RHSA-2026:17625)
- [https://access.redhat.com/errata/RHSA-2026:17626](https://access.redhat.com/errata/RHSA-2026:17626)

## Related threats

- [Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service)
- [Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass)
- [Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression)
- [Open-Xchange Dovecot Sieve CPU resource accounting bypass](https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass)
- [Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted)