CVE-2026-33605: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro

This vulnerability (CVE-2026-33605) allows an unauthenticated attacker to cause uncontrolled resource consumption by crashing the ManageSieve login process in OX Dovecot Pro. The attack involves sending a malformed command before authentication. The impact differs by mode: in high-security mode, only the attacker's connection is dropped; in high-performance mode, all connections managed by the same login process are terminated, potentially causing denial of service for Sieve script management. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). No exploits are publicly available, and no official patch links are provided in the data.

The vulnerability can cause denial of service by terminating ManageSieve login processes. In community releases (high-security mode), the impact is limited to the attacker's own connection being terminated. In Pro releases (high-performance mode), the impact is broader, terminating all connections handled by the same managesieve-login process, disrupting Sieve script management for multiple users. There is no confidentiality or integrity impact reported.

Restrict network access to the ManageSieve service to trusted clients to reduce exposure. The data advises updating to a non-vulnerable version, but no specific patch or fixed version is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.