Vulnerability · Published Mar 27, 2026 · Assigned by OX
CVE-2026-27858
High 7.5
In plain English
A high-severity uncontrolled resource consumption in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 43.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | dovecot | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:9 | dovecot | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| AlmaLinux:10 | dovecot-devel | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot-devel | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot-devel | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot-devel | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| AlmaLinux:9 | dovecot-devel | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:10 | dovecot-mysql | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot-mysql | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot-mysql | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot-mysql | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| AlmaLinux:9 | dovecot-mysql | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:10 | dovecot-pgsql | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot-pgsql | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot-pgsql | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot-pgsql | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:9 | dovecot-pgsql | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| AlmaLinux:10 | dovecot-pigeonhole | 1:2.3.21-19.el10_2 | ALSA-2026:19149 |
| AlmaLinux:10 | dovecot-pigeonhole | 1:2.3.21-16.el10_1.1 | ALSA-2026:13498 |
| AlmaLinux:8 | dovecot-pigeonhole | 1:2.3.16-7.el8_10 | ALSA-2026:13830 |
| AlmaLinux:9 | dovecot-pigeonhole | 1:2.3.16-18.el9_8 | ALSA-2026:19364 |
| AlmaLinux:9 | dovecot-pigeonhole | 1:2.3.16-15.el9_7.1 | ALSA-2026:13857 |
| Debian:12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u2 | DEBIAN-CVE-2026-27858 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u4 | DEBIAN-CVE-2026-27858 |
| Debian:14 | dovecot | 1:2.4.3+dfsg1-1 | DEBIAN-CVE-2026-27858 |
| Rocky Linux:10 | dovecot | 1:2.3.21-16.el10_1.1 | RLSA-2026:13498 |
| Rocky Linux:10 | dovecot | 1:2.3.21-19.el10_2 | RLSA-2026:19149 |
| Rocky Linux:8 | dovecot | 1:2.3.16-7.el8_10 | RLSA-2026:13830 |
| Rocky Linux:9 | dovecot | 1:2.3.16-18.el9_8 | RLSA-2026:19364 |
| Rocky Linux:9 | dovecot | 1:2.3.16-15.el9_7.1 | RLSA-2026:13857 |
| Ubuntu:22.04:LTS | dovecot | 1:2.3.16+dfsg1-3ubuntu2.7 | UBUNTU-CVE-2026-27858 |
| Ubuntu:24.04:LTS | dovecot | 1:2.3.21+dfsg1-2ubuntu6.3 | UBUNTU-CVE-2026-27858 |
| Ubuntu:25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.1 | UBUNTU-CVE-2026-27858 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 0 – through 2.3.00 – through 3.1.00 – through 2.4.0 |
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-27858 vdb-entry, x_refsource_REDHAT
- RHBZ#2452175 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27858.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:26564 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17602 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13498 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19149 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13830 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19455 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19453 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18053 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17630 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17628 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17625 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17626 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13857 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19364 vendor-advisory, x_refsource_REDHAT