Sieve CPU Resource Exhaustion in Dovecot by Open-Xchange

CVE-2026-52681

What is CVE-2026-52681?

The Sieve feature in Dovecot allows an attacker with valid credentials to manipulate CPU resource tracking by altering the active script. This capability can lead to a bypass of the configured CPU limit, resulting in sustained CPU consumption that degrades mail delivery services. Additionally, compiled script files persist even after deletion or renaming, contributing to increasing disk usage. System administrators should monitor for unusual CPU and disk activity and promptly apply updates to secure the product against potential exploitation.

References