ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-pgsqlUpgrade dovecot-pigeonholeUpgrade dovecot-devel | May 6, 2026 | May 5, 2026 |
| Debian | — | Upgrade dovecot | Apr 7, 2026 | Apr 7, 2026 |
| Oracle_linux | — | Upgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecotUpgrade dovecot-pgsqlUpgrade dovecot-devel | May 6, 2026 | Mar 27, 2026 |
| Redhat_linux | — | Upgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-debugsourceUpgrade dovecot-develUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonholeUpgrade dovecot-mysql-debuginfoUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-debuginfoNo solution existsUpgrade dovecot-pgsql | May 6, 2026 | Mar 27, 2026 |
| Rocky_linux | — | Upgrade dovecot-develUpgrade dovecot-pigeonholeUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-pgsqlUpgrade dovecot-debuginfoUpgrade dovecot-debugsourceUpgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-mysql-debuginfo | May 11, 2026 | May 7, 2026 |
| Ubuntu | — | Upgrade dovecot-core | Apr 1, 2026 | Mar 31, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub