Threats Tagged 'cve-2026-40013'

Multiple critical security vulnerabilities affecting Dovecot 2.4.4 and related versions in Red Hat Enterprise Linux 8 have been addressed in an update to version 2.3.16-16.el8_10. These vulnerabilities include denial of service, authentication bypass, and remote code execution issues across various Dovecot components such as IMAP, ManageSieve, and sieve scripts. The update fixes critical issues including a use-after-free leading to arbitrary code execution and several denial of service vulnerabilities caused by malformed inputs or resource exhaustion.

CVE-2026-40013 is a buffer underwrite vulnerability in Open-Xchange GmbH OX Dovecot Pro's ManageSieve service. An attacker with valid credentials can submit a Sieve script containing an extreme numeric literal that triggers an out-of-bounds write during script compilation. This causes memory corruption and crashes the ManageSieve process, resulting in denial of service for script management. There are no known public exploits. Disabling the ManageSieve service if not needed and updating to a non-vulnerable version are recommended.

CVE-2026-40013 is a buffer underwrite vulnerability in Open-Xchange GmbH OX Dovecot Pro's ManageSieve service. An attacker with valid credentials can submit a Sieve script containing an extreme numeric literal that triggers an out-of-bounds write during script compilation. This leads to memory corruption and crashes the ManageSieve process, causing denial of service for script management. There are no known public exploits. Disabling the ManageSieve service if not needed and updating to a non-vulnerable version are recommended.