CVE-2026-33605
published 2026-08-28CVE-2026-33605: An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.45%
38.0th percentile
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.0 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.0 < 2.3.22.2 | 2.3.22.2 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.0.0 < 3.0.7 | 3.0.7 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.1.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dovecot: Dovecot: Denial of Service in ManageSieve login process
vendor_redhat·2026-08-28·CVSS 7.5
CVE-2026-33605 [HIGH] CWE-1286 dovecot: Dovecot: Denial of Service in ManageSieve login process
dovecot: Dovecot: Denial of Service in ManageSieve login process
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot. An unauthenticated attacker can crash the ManageSieve login process by sending a small malfo
GHSA
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.
ghsa_unreviewed·2026-08-28
CVE-2026-33605 [HIGH] CWE-400 An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33605 dovecot: Dovecot: Denial of Service in ManageSieve login process [fedora-all]
bugzilla·2026-09-01·CVSS 7.5
CVE-2026-33605 [HIGH] CVE-2026-33605 dovecot: Dovecot: Denial of Service in ManageSieve login process [fedora-all]
CVE-2026-33605 dovecot: Dovecot: Denial of Service in ManageSieve login process [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. Restrict network
Bugzilla
CVE-2026-33605 dovecot: Dovecot: Denial of Service in ManageSieve login process
bugzilla·2026-08-28·CVSS 7.5
CVE-2026-33605 [HIGH] CVE-2026-33605 dovecot: Dovecot: Denial of Service in ManageSieve login process
CVE-2026-33605 dovecot: Dovecot: Denial of Service in ManageSieve login process
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
2026-08-28
Published