InfoSec Signals™
Sign InStart Free
Back to CVE records
High 7.5Published Mar 27, 2026

CVE-2026-27858Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.

Updated under an hour ago ()

Does this affect you?

It affects Open-Xchange GmbH OX Dovecot Pro and 10 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

CVSS
7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-400, CWE-770
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
OX
NVD analysis
Modified
Record last updated
Jul 14, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
Open-Xchange GmbH OX Dovecot Pro
open_xchange:ox_dovecot_pro (from the name)
through 2.3.0; through 3.1.0; through 2.4.0
CNA record
from 1:2.3.21-16.el10_1.1 not affected; from 1:2.3.21-19.el10_2 not affected
CISA ADP
from 1:2.3.21-16.el10_0.1 not affected
CISA ADP
from 1:2.2.36-8.el7_9.1 not affected
CISA ADP
from 1:2.3.8-9.el8_4.1 not affected
CISA ADP
from 1:2.3.8-9.el8_4.1 not affected
CISA ADP
from 1:2.3.16-2.el8_6.1 not affected
CISA ADP
from 1:2.3.16-2.el8_6.1 not affected
CISA ADP
from 1:2.3.16-11.el9_4.2 not affected
CISA ADP
dovecot dovecot
dovecot:dovecot
before 2.4.3
NVD

References

References

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.