CVE-2026-40016: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro
Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known.
AI Analysis
Technical Summary
This vulnerability in OX Dovecot Pro enables an attacker with local or ManageSieve service access to upload a crafted Sieve script that circumvents the CPU time restrictions configured for Sieve script execution. By bypassing these limits by a factor of up to 130, the attacker can cause uncontrolled resource consumption, leading to server performance degradation. The vulnerability does not impact confidentiality or integrity but affects availability. No official remediation level or patch link is provided in the data, and no known exploits are reported.
Potential Impact
The vulnerability allows denial of service through resource exhaustion by bypassing CPU time limits on Sieve scripts, which can degrade server performance and availability. There is no impact on confidentiality or integrity. No known exploitation in the wild has been reported.
Mitigation Recommendations
The vendor recommends installing a fixed version of OX Dovecot Pro when available. Alternatively, administrators can mitigate the risk by preventing direct access to Sieve scripts via the ManageSieve service or local access. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
CVE-2026-40016: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro
Description
Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in OX Dovecot Pro enables an attacker with local or ManageSieve service access to upload a crafted Sieve script that circumvents the CPU time restrictions configured for Sieve script execution. By bypassing these limits by a factor of up to 130, the attacker can cause uncontrolled resource consumption, leading to server performance degradation. The vulnerability does not impact confidentiality or integrity but affects availability. No official remediation level or patch link is provided in the data, and no known exploits are reported.
Potential Impact
The vulnerability allows denial of service through resource exhaustion by bypassing CPU time limits on Sieve scripts, which can degrade server performance and availability. There is no impact on confidentiality or integrity. No known exploitation in the wild has been reported.
Mitigation Recommendations
The vendor recommends installing a fixed version of OX Dovecot Pro when available. Alternatively, administrators can mitigate the risk by preventing direct access to Sieve scripts via the ManageSieve service or local access. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- OX
- Date Reserved
- 2026-04-08T09:59:59.342Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0333e5cbff5d8610ef1d2e
Added to database: 5/12/2026, 2:06:29 PM
Last enriched: 5/12/2026, 2:22:36 PM
Last updated: 5/13/2026, 4:45:24 AM
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.