Is CVE-2026-40016 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40016 being exploited in the wild.

How severe is CVE-2026-40016?

Medium severity, with a CVSS score of 5.3, published 12 May 2026.

Which products and versions are affected?

Open-Xchange Dovecot CE 2.4.0 through 2.4.3, 2.4.0 to 2.4.3; Open-Xchange Dovecot Pro 2.3.0 through 3.1.4, 2.3.0 to 3.1.4.

Is there a fix for CVE-2026-40016?

A patch was published on 2026-05-05: Initial internal release of fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40016 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-40016?

Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40016: Open-Xchange Dovecot CPU limit bypass in Sieve scripts

CVE-2026-40016 · Severity: medium · CVSS 5.3 · Published 2026-05-12

A vulnerability in the Dovecot email server allows an attacker to upload specially crafted scripts that bypass safety limits on processor usage. By exceeding these limits by up to 130 times the intended amount, an attacker can consume excessive server resources. This can lead to significant performance degradation or a complete service outage for other email users.

Technologies: Dovecot, Open-Xchange Dovecot CE, Open-Xchange Dovecot Pro. Vendors: Dovecot, Open-Xchange.

Quick answers

Is CVE-2026-40016 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40016 being exploited in the wild.
How severe is CVE-2026-40016?: Medium severity, with a CVSS score of 5.3, published 12 May 2026.
Which products and versions are affected?: Open-Xchange Dovecot CE 2.4.0 through 2.4.3, 2.4.0 to 2.4.3; Open-Xchange Dovecot Pro 2.3.0 through 3.1.4, 2.3.0 to 3.1.4.
Is there a fix for CVE-2026-40016?: A patch was published on 2026-05-05: Initial internal release of fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40016 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-40016?: Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource consumption vulnerability (CWE-400) exists in Open-Xchange Dovecot's Sieve script execution engine. An authenticated attacker can upload a malicious Sieve script via the ManageSieve service or local access that bypasses the enforced CPU time limits. The flaw allows scripts to run for up to 130 times the configured limit, enabling a denial-of-service (DoS) condition by degrading server performance. The vulnerability is addressed in Dovecot Pro 3.1.5 and Dovecot CE 2.4.4. Temporary mitigations include disabling the ManageSieve service or restricting local script access.

Affected products

Open-Xchange Dovecot Pro 2.3.0 through 3.1.4
Open-Xchange Dovecot CE 2.4.0 through 2.4.3

Timeline

2026-05-05: patched: Initial internal release of fix
2026-05-12: advisory: Public release of advisory OXDC-ADV-2026-0002
2026-05-12: disclosed: NVD publication date

References

https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.