Vulnerability · Published May 12, 2026 · Assigned by OX
CVE-2026-40016
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | dovecot | 2.4.4-r0 | ALPINE-CVE-2026-40016 |
| Alpine:v3.24 | dovecot | 2.4.4-r0 | ALPINE-CVE-2026-40016 |
| Debian:12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u6 | DEBIAN-CVE-2026-40016 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u6 | DEBIAN-CVE-2026-40016 |
| Debian:14 | dovecot | 1:2.4.4+dfsg1-1 | DEBIAN-CVE-2026-40016 |
| Ubuntu:22.04:LTS | dovecot | 1:2.3.16+dfsg1-3ubuntu2.9 | UBUNTU-CVE-2026-40016 |
| Ubuntu:24.04:LTS | dovecot | 1:2.3.21+dfsg1-2ubuntu6.5 | UBUNTU-CVE-2026-40016 |
| Ubuntu:25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.2 | UBUNTU-CVE-2026-40016 |
| Ubuntu:26.04:LTS | dovecot | 1:2.4.2+dfsg1-3ubuntu2.1 | UBUNTU-CVE-2026-40016 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 0 – through 2.3.0 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H