Memory Allocation Vulnerability in Dovecot Product by Open-Xchange
CVE-2026-27858

7.5HIGH

Key Information:

Vendor

Open-xchange Gmbh

Status
Ox Dovecot Pro
Vendor
CVE Published:
27 March 2026

What is CVE-2026-27858?

A vulnerability in the Dovecot product by Open-Xchange enables attackers to send crafted messages that cause excessive memory allocation in the managesieve component. This can lead to the repeated crashing of the managesieve-login process, making it unavailable for legitimate users. It is essential to protect access to the managesieve protocol or to install a patched version to mitigate the risk associated with this vulnerability. No public exploits are currently known.

Affected Version(s)

OX Dovecot Pro 0 <= 2.3.0

OX Dovecot Pro 0 <= 3.1.0

OX Dovecot Pro 0 <= 2.4.0

References

https://documentation.open-xchange.com/dovecot/security/a...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.