Executive brief
Dovecot is an open-source email server that provides ManageSieve, a service for managing Sieve email filtering scripts. An unauthenticated attacker can crash the ManageSieve login process by sending a malformed command before authentication, causing denial of service. Depending on configuration, this can disconnect only the attacker's session or—in high-performance mode—terminate all connections handled by the same process, preventing users from managing their email filters.
Technical details
This is a denial-of-service vulnerability in Dovecot's ManageSieve login handler triggered by a small malformed command sent before authentication. The vulnerability does not require authentication or user interaction, making it trivially exploitable from the network. The impact varies by deployment mode: in high-security mode (default for community releases), only the attacker's connection is terminated; in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are affected. Repeated exploitation can systematically deny service to legitimate users attempting to manage Sieve scripts. Patches are available in Dovecot Pro 2.3.22.2, 3.0.7, and 3.1.6, and corresponding community releases.
Affected products
- Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5
- Dovecot Dovecot <2.3.22.2, <3.0.7, <3.1.6
Timeline
- 2026-08-28: disclosed: Public disclosure via NVD and Open-Xchange advisory
- 2026-08-26: advisory: Initial advisory release (OXDC-ADV-2026-0003)