CVE-2026-33605: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro

CVE-2026-33605 describes an uncontrolled resource consumption vulnerability in the ManageSieve login process of OX Dovecot Pro. An unauthenticated attacker can cause the login process to crash by sending a small malformed command before authentication. The impact differs by mode: in high-security mode, only the attacker's connection is terminated, while in high-performance mode, all connections managed by the same login process are terminated, potentially causing denial of service for Sieve script management. The vulnerability affects specific versions including 2.3.0, 3.0.0, and 3.1.0. No known public exploits exist. The vendor has not provided explicit remediation details or patches in the available data.

The vulnerability allows unauthenticated attackers to cause denial of service by crashing the ManageSieve login process. In community (high-security) mode, only the attacker's connection is affected, limiting impact. In Pro (high-performance) mode, all connections handled by the same login process are terminated, potentially disrupting multiple users. This impacts availability of Sieve script management functionality but does not affect confidentiality or integrity.

Restrict network access to the ManageSieve service to trusted clients to reduce exposure. The vendor advisory does not specify an official patch or fix; therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Updating to a non-vulnerable version is recommended once available.