CVE-2026-40019: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot CE

This vulnerability allows an unauthenticated attacker to trigger an infinite loop in the ManageSieve login process of OX Dovecot CE by sending a truncated quoted argument. The infinite loop results in uncontrolled CPU consumption, potentially leading to denial of service conditions affecting Sieve script management. The affected version explicitly identified is 2.4.3. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged confidentiality and integrity, but high impact on availability.

Successful exploitation causes high CPU usage on the server running the ManageSieve service, which can degrade or deny service for Sieve script management. This may impact availability but does not affect confidentiality or integrity. No known public exploits exist.

No official patch or fix has been confirmed as of the published date. Recommended mitigations include monitoring system CPU usage to detect abnormal spikes and terminating offending processes. Network access to the ManageSieve service should be restricted to trusted clients to reduce exposure. Users should check the vendor advisory for updates on patches or official remediation.