This vulnerability involves uncontrolled resource consumption in the managesieve service of OX Dovecot Pro. An attacker can send a crafted message prior to authentication that causes managesieve to allocate a large amount of memory, leading to repeated crashes of the managesieve-login process and denial of service. The CVSS v3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. Red Hat has released security advisories and patches for affected Red Hat Enterprise Linux 7 Extended Life Cycle Support versions to mitigate this issue.

Successful exploitation results in denial of service by crashing the managesieve-login process repeatedly, making the managesieve protocol unavailable. There is no confidentiality or integrity impact reported. No known public exploits exist at this time.

Red Hat has released security updates for affected Red Hat Enterprise Linux 7 Extended Life Cycle Support packages that fix this vulnerability. Users should apply these official patches as detailed in the Red Hat advisories (e.g., RHSA-2026:26564). Alternatively, restricting or protecting access to the managesieve protocol can mitigate exploitation risk. Patch status is confirmed by Red Hat advisories; therefore, applying the vendor-provided updates is the recommended remediation.