CVE-2026-40019: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot CE

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process in OX Dovecot CE 2.4.3, causing the process to spin in an infinite loop and consume excessive CPU resources. This uncontrolled resource consumption can degrade or deny service for Sieve script management. The vulnerability is identified as CWE-400 (Uncontrolled Resource Consumption). The CVSS v3.1 base score is 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability (no confidentiality or integrity impact). No known public exploits exist.

The vulnerability can cause denial of service by exhausting CPU resources on the server running the ManageSieve service, impacting the availability of Sieve script management. There is no impact on confidentiality or integrity. Repeated exploitation attempts can consume all available CPU, potentially affecting other services on the server.

Update to a non-vulnerable version of OX Dovecot CE when available. Until then, monitor system CPU usage for abnormal spikes and terminate offending ManageSieve processes. Restrict network access to the ManageSieve service to trusted clients only. No official patch or vendor advisory is provided in the input data, so check the vendor's site for updates.