Vulnerability · Published Mar 27, 2026 · Assigned by OX
CVE-2025-59028
Medium 5.3
In plain English
A medium-severity improper input validation in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | dovecot | 2.4.3-r0 | ALPINE-CVE-2025-59028 |
| Alpine:v3.24 | dovecot | 2.4.3-r0 | ALPINE-CVE-2025-59028 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u4 | DEBIAN-CVE-2025-59028 |
| Debian:14 | dovecot | 1:2.4.3+dfsg1-1 | DEBIAN-CVE-2025-59028 |
| Ubuntu:25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.1 | UBUNTU-CVE-2025-59028 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 0 – through 3.1.00 – through 2.4.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L