CVEvulnerability

CVE-2025-59032

7.5 HIGH Published 2026-03-27 Modified 2026-10-07 Official page ↗
Status
Modified
Published
2026-03-27
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-229

Description

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.

Affected configurations

• dovecot dovecot (< 2.4.3) • open-xchange dovecot (< 3.1.3)

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-229 Improper Handling of Values weakness

References