Vulnerability · Published Mar 27, 2026 · Assigned by OX
CVE-2025-59032
High 7.5
In plain English
A high-severity improper input validation in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 45.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | dovecot | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:9 | dovecot | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| AlmaLinux:10 | dovecot-devel | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot-devel | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot-devel | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot-devel | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| AlmaLinux:9 | dovecot-devel | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:10 | dovecot-mysql | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot-mysql | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot-mysql | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot-mysql | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| AlmaLinux:9 | dovecot-mysql | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:10 | dovecot-pgsql | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot-pgsql | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot-pgsql | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot-pgsql | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:9 | dovecot-pgsql | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| AlmaLinux:10 | dovecot-pigeonhole | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot-pigeonhole | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot-pigeonhole | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot-pigeonhole | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:9 | dovecot-pigeonhole | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| Debian:12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u2 | DEBIAN-CVE-2025-59032 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u4 | DEBIAN-CVE-2025-59032 |
| Debian:14 | dovecot | 1:2.4.3+dfsg1-1 | DEBIAN-CVE-2025-59032 |
| Rocky Linux:10 | dovecot | 1:2.3.21-16.el10_1.1 | RLSA-2026:13498 |
| Rocky Linux:10 | dovecot | 1:2.3.21-19.el10_2 | RLSA-2026:19149 |
| Rocky Linux:8 | dovecot | 1:2.3.16-7.el8_10 | RLSA-2026:13830 |
| Rocky Linux:9 | dovecot | 1:2.3.16-18.el9_8 | RLSA-2026:19364 |
| Rocky Linux:9 | dovecot | 1:2.3.16-15.el9_7.1 | RLSA-2026:13857 |
| Ubuntu:22.04:LTS | dovecot | 1:2.3.16+dfsg1-3ubuntu2.7 | UBUNTU-CVE-2025-59032 |
| Ubuntu:24.04:LTS | dovecot | 1:2.3.21+dfsg1-2ubuntu6.3 | UBUNTU-CVE-2025-59032 |
| Ubuntu:25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.1 | UBUNTU-CVE-2025-59032 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 0 – through 3.1.00 – through 2.4.0 |
Weakness: CWE-20, CWE-229 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-59032 vdb-entry, x_refsource_REDHAT
- RHBZ#2452172 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59032.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:26564 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17602 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13498 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19149 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13830 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19455 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19453 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18053 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17630 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17628 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17625 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17626 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13857 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19364 vendor-advisory, x_refsource_REDHAT