Threats Tagged 'cve-2026-33605'

Multiple critical security vulnerabilities affecting Dovecot 2.4.4 and related versions in Red Hat Enterprise Linux 8 have been addressed in an update to version 2.3.16-16.el8_10. These vulnerabilities include denial of service, authentication bypass, and remote code execution issues across various Dovecot components such as IMAP, ManageSieve, and sieve scripts. The update fixes critical issues including a use-after-free leading to arbitrary code execution and several denial of service vulnerabilities caused by malformed inputs or resource exhaustion.

CVE-2026-33605 is a high-severity vulnerability in Open-Xchange GmbH OX Dovecot Pro affecting the ManageSieve login process. An unauthenticated attacker can send a small malformed command before authentication to crash the ManageSieve login process. In high-security mode (default for community releases), only the attacker's connection is terminated, while in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. This can lead to denial of service for Sieve script management. No public exploits are known. Network access to ManageSieve should be restricted to trusted clients, and updating to a non-vulnerable version is recommended.

CVE-2026-33605 is a high-severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro affecting ManageSieve login. An unauthenticated attacker can send a malformed command before authentication to crash the ManageSieve login process. In high-security mode (default for community releases), only the attacker's connection is terminated, but in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. This can lead to denial of service for Sieve script management. No public exploits are known. Restricting network access to trusted clients and updating to a non-vulnerable version are recommended.