Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-40019 EUVD-2026-67668GHSA-c3mr-h4j4-h26r

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop …

Published Aug 28, 2026 · Updated Aug 28, 2026 · Assigned by OX

Vendor: Open-Xchange Product: OX Dovecot CE Package: dovecot Package: dovecot Package: dovecot Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.

Affected products

VendorProductAffectedFixed
Open-Xchange OX Dovecot CE 2.4.3 – < 2.4.5 2.4.5

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 dovecot 1:2.4.5+dfsg1-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS dovecot No fix yet —
Ubuntu 24.04 LTS dovecot No fix yet —
Ubuntu 22.04 LTS dovecot No fix yet —
Ubuntu 20.04 LTS dovecot No fix yet —
Ubuntu 18.04 LTS dovecot No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS dovecot No fix yet —
Ubuntu Pro 14.04 LTS dovecot No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 dovecot +4 1:2.3.21-19.el10_2.8 RHSA-2026:98587, RHSA-2026:79371
RHEL 9 dovecot +4 1:2.3.16-18.el9_8.8 RHSA-2026:98477, RHSA-2026:80825
RHEL 8 dovecot +4 1:2.3.16-16.el8_10 RHSA-2026:76763

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 dovecot +4 1:2.3.21-19.el10_2.8 ALSA-2026:79371
AlmaLinux 9 dovecot +4 1:2.3.16-18.el9_8.8 ALSA-2026:80825
AlmaLinux 8 dovecot +4 1:2.3.16-16.el8_10 ALSA-2026:76763

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 dovecot 1:2.3.21-19.el10_2.8 RLSA-2026:98587, RLSA-2026:79371
Rocky Linux 10 dovecot-devel +3 1:2.3.21-22.el10_3 RLSA-2026:98587
Rocky Linux 9 dovecot 1:2.3.16-18.el9_8.8 RLSA-2026:98477, RLSA-2026:80825
Rocky Linux 9 dovecot-devel +3 1:2.3.16-21.el9_9 RLSA-2026:98477
Rocky Linux 8 dovecot 1:2.3.16-16.el8_10 RLSA-2026:76763

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 dovecot23 2.3.21.1-150200.76.1 SUSE-SU-2026:4139-1
SLES 15 SP6 dovecot23 2.3.21.1-150200.76.1 SUSE-SU-2026:4139-1
SLES 15 SP5 dovecot23 2.3.21.1-150200.76.1 SUSE-SU-2026:4139-1
SLES 15 SP4 dovecot23 2.3.21.1-150200.76.1 SUSE-SU-2026:4139-1
SLES 12 SP5 dovecot22 2.2.31-19.40.1 SUSE-SU-2026:3919-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 dovecot23 2.3.21.1-150200.76.1 SUSE-SU-2026:4139-1
SLES for SAP 15 SP5 dovecot23 2.3.21.1-150200.76.1 SUSE-SU-2026:4139-1
SLES for SAP 15 SP4 dovecot23 2.3.21.1-150200.76.1 SUSE-SU-2026:4139-1
SLE HPC 15 SP5 dovecot23 2.3.21.1-150200.76.1 SUSE-SU-2026:4139-1
SLE HPC 15 SP4 dovecot23 2.3.21.1-150200.76.1 SUSE-SU-2026:4139-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed dovecot24 2.4.5-1.1 openSUSE-SU-2026:11629-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 dovecot 2.4.5-r0 —
Alpine v3.23 dovecot 2.4.5-r0 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 dovecot +4 1:2.3.21-19.el10_2.8 ELSA-2026-79371
Oracle Linux 9 dovecot +4 1:2.3.16-18.el9_8.8 ELSA-2026-80825
Oracle Linux 8 dovecot +4 1:2.3.16-16.el8_10 ELSA-2026-76763

Advisories 20

References