The vulnerability arises from improper validation of base64-encoded SASL authentication data in OX Dovecot Pro. When invalid base64 data is sent, the login process disconnects from the authentication server, causing all active authentication sessions to fail and effectively denying service to users attempting concurrent logins. This can be exploited to disrupt service availability. The CVSS 3.1 score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability loss. No known public exploits exist. Mitigation options include applying a fixed software version or disabling concurrency in login processes, the latter incurring a heavy performance penalty on large deployments.

The vulnerability allows an attacker to cause denial of service by sending invalid base64 SASL data, which disconnects the login process from the authentication server and breaks all active authentication sessions. This disrupts concurrent logins and impacts service availability. There is no impact on confidentiality or integrity. No known exploits are publicly available.

A fixed version of OX Dovecot Pro addressing this vulnerability should be installed when available. Alternatively, concurrency in login processes can be disabled to mitigate the issue, but this results in significant performance degradation in large deployments. Patch status is not explicitly confirmed in the provided data; users should monitor the vendor advisory for official fixes.