CVE-2026-27858Uncontrolled Resource Consumption in Dovecot

Severity
7.5HIGHNVD
OSV5.3
EPSS
0.1%
top 82.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 27
Latest updateMar 31

Description

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

debiandebian/dovecot< dovecot 1:2.3.19.1+dfsg1-2.1+deb12u2 (bookworm)
Debiandovecot/dovecot< 1:2.3.19.1+dfsg1-2.1+deb12u2+1
Ubuntudovecot/dovecot< 1:2.3.16+dfsg1-3ubuntu2.7+2

🔴Vulnerability Details

3
OSV
dovecot vulnerabilities2026-03-31
GHSA
GHSA-xr7v-hj32-mr4r: Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory2026-03-27
OSV
CVE-2026-27858: Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory2026-03-27

📋Vendor Advisories

3
Ubuntu
Dovecot vulnerabilities2026-03-31
Red Hat
dovecot: denial of service via crafted message before authentication2026-03-27
Debian
CVE-2026-27858: dovecot - Attacker can send a specifically crafted message before authentication that caus...2026

🕵️Threat Intelligence

11
Wiz
CVE-2026-27858 Impact, Exploitability, and Mitigation Steps | Wiz
Wiz
CVE-2026-0394 Impact, Exploitability, and Mitigation Steps | Wiz
Wiz
CVE-2026-27856 Impact, Exploitability, and Mitigation Steps | Wiz
Wiz
CVE-2026-27855 Impact, Exploitability, and Mitigation Steps | Wiz
Wiz
CVE-2025-59032 Impact, Exploitability, and Mitigation Steps | Wiz