CVE-2026-27858

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-27 · updated 2026-10-26
Weakness: CWE-400

Description

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Affected products

dovecot: before 2.4.3 — fixed in 2.4.3
Open-Xchange Dovecot: before 2.3.22.1; from 3.0.0 before 3.0.5; from 3.1.0 before 3.1.4 — fixed in 2.3.22.1, 3.0.5, 3.1.4

How to fix

Upgrade to a fixed version: dovecot 2.4.3; Open-Xchange Dovecot 2.3.22.1, 3.0.5, 3.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-27858 or the next vulnerability affects your stack