# CVE-2026-33605: Dovecot ManageSieve denial of service via malformed pre-auth command

Source: https://junglewise.ai/threats/cve-2026-33605-dovecot-managesieve-denial-of-service-via-malformed-pre-auth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-33605 · Severity: high · CVSS 7.5 · Published 2026-08-28

Dovecot is an open-source email server that provides ManageSieve, a service for managing Sieve email filtering scripts. An unauthenticated attacker can crash the ManageSieve login process by sending a malformed command before authentication, causing denial of service. Depending on configuration, this can disconnect only the attacker's session or—in high-performance mode—terminate all connections handled by the same process, preventing users from managing their email filters.

Technologies: [Dovecot](https://junglewise.ai/threats/technologies/dovecot), [Open-Xchange Dovecot Pro](https://junglewise.ai/threats/technologies/dovecot-pro). Vendors: [Dovecot](https://junglewise.ai/threats/vendors/dovecot), [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2026-33605 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33605 being exploited in the wild.

**How severe is CVE-2026-33605?** High severity, with a CVSS score of 7.5, published 28 August 2026.

**Which products and versions are affected?** Dovecot <2.3.22.2, <3.0.7, <3.1.6; Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5.

**Is there a fix for CVE-2026-33605?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33605 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-33605?** Check whether you run Dovecot or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a denial-of-service vulnerability in Dovecot's ManageSieve login handler triggered by a small malformed command sent before authentication. The vulnerability does not require authentication or user interaction, making it trivially exploitable from the network. The impact varies by deployment mode: in high-security mode (default for community releases), only the attacker's connection is terminated; in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are affected. Repeated exploitation can systematically deny service to legitimate users attempting to manage Sieve scripts. Patches are available in Dovecot Pro 2.3.22.2, 3.0.7, and 3.1.6, and corresponding community releases.

## Affected products

- Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5
- Dovecot Dovecot <2.3.22.2, <3.0.7, <3.1.6

## Timeline

- 2026-08-28: disclosed: Public disclosure via NVD and Open-Xchange advisory
- 2026-08-26: advisory: Initial advisory release (OXDC-ADV-2026-0003)

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json)

## Related threats

- [Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service)
- [Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass)
- [Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression)
- [Open-Xchange Dovecot Sieve CPU resource accounting bypass](https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass)
- [Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted)