CVE-2026-27858 — Uncontrolled Resource Consumption in Dovecot
Severity
7.5HIGHNVD
OSV5.3
EPSS
0.1%
top 82.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 27
Latest updateMar 31
Description
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages4 packages
🔴Vulnerability Details
3GHSA▶
GHSA-xr7v-hj32-mr4r: Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory↗2026-03-27
OSV▶
CVE-2026-27858: Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory↗2026-03-27