Sieve Script Bypass Vulnerability in Dovecot by Open-Xchange

CVE-2026-40016

What is CVE-2026-40016?

A vulnerability exists in the Dovecot email server related to the Sieve scripting feature. An attacker can exploit this vulnerability by uploading a malicious Sieve script through the ManageSieve service or locally. This compromise allows the attacker to bypass configured CPU time limitations, potentially increasing the server's CPU usage by up to 130 times beyond the defined limits. This exploitation can lead to significant degradation of server performance, affecting overall system stability. Users are encouraged to install the fixed version or to restrict direct access to Sieve scripts to mitigate this vulnerability.

References