# CVE-2026-52681: Open-Xchange Dovecot Sieve CPU resource accounting bypass

Source: https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-52681 · Severity: low · CVSS 3.1 · Published 2026-08-28

Dovecot's Sieve mail filtering service tracks CPU usage to prevent runaway scripts from consuming server resources. An attacker with valid mail credentials can repeatedly switch between Sieve scripts to reset the accounting counters, bypassing the configured CPU limit and causing sustained CPU consumption. Additionally, compiled script files are not cleaned up when deleted, wasting disk space. Together, these issues can degrade mail delivery performance and availability for legitimate users.

Technologies: [Open-Xchange Dovecot Pro](https://junglewise.ai/threats/technologies/dovecot-pro). Vendors: [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2026-52681 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52681 being exploited in the wild.

**How severe is CVE-2026-52681?** Low severity, with a CVSS score of 3.1, published 28 August 2026.

**Which products and versions are affected?** Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5.

**Is there a fix for CVE-2026-52681?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52681 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-52681?** Check whether you run Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource accounting bypass in the Sieve script engine. CPU usage is tracked per compiled script object, and an authenticated attacker can reset the accounting by repeatedly changing the active Sieve script; each script change creates a new compiled script object with zeroed counters. Additionally, compiled script files are not removed when scripts are deleted or renamed, leading to disk space exhaustion over time. The attacker requires valid mail account credentials to change their Sieve scripts, making this an authenticated attack. The combined effects allow sustained CPU consumption beyond configured limits and increased disk I/O contention, degrading mail delivery service. Patches are available in OX Dovecot Pro 2.3.22.2, 3.0.7, and 3.1.6 or later.

## Affected products

- Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5

## Timeline

- 2026-08-28: disclosed

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json)

## Related threats

- [Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service)
- [Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass)
- [Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression)
- [Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted)
- [Open-Xchange Dovecot information disclosure in IMAP URLFETCH](https://junglewise.ai/threats/cve-2026-42392-open-xchange-dovecot-information-disclosure-in-imap-urlfetch)