This vulnerability in OX Dovecot Pro involves the managesieve protocol component, where an attacker can send crafted messages prior to authentication that trigger large memory allocations. Repeated exploitation can crash the managesieve-login process, resulting in denial of service. The attack requires no privileges or user interaction and can be performed remotely over the network. The CVSS 3.1 score is 7.5, reflecting high impact on availability with no impact on confidentiality or integrity.

An attacker can cause a denial of service by exhausting memory resources in the managesieve service, leading to repeated crashes of the managesieve-login process and unavailability of the managesieve protocol. There is no impact on data confidentiality or integrity. No known exploits are publicly available at this time.

The vendor has not provided specific patch or remediation details in the available data. It is recommended to protect access to the managesieve protocol, for example by network-level controls or access restrictions, to reduce exposure. Check the vendor advisory for updates regarding official patches or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.