CVE-2026-40019
published 2026-08-28CVE-2026-40019: An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.37%
29.9th percentile
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.4.3 < 2.4.5 | 2.4.5 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU.
ghsa_unreviewed·2026-08-28
CVE-2026-40019 [MEDIUM] CWE-400 An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU.
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
Red Hat
dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve
vendor_redhat·2026-08-28·CVSS 5.9
CVE-2026-40019 [MEDIUM] CWE-835 dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve
dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the p
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-40019 dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve [fedora-all]
bugzilla·2026-09-01·CVSS 5.9
CVE-2026-40019 [MEDIUM] CVE-2026-40019 dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve [fedora-all]
CVE-2026-40019 dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerabl
Bugzilla
CVE-2026-40019 dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve
bugzilla·2026-08-28·CVSS 5.9
CVE-2026-40019 [MEDIUM] CVE-2026-40019 dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve
CVE-2026-40019 dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
2026-08-28
Published