CVE-2026-27858 Denial of service in OX Dovecot Pro
An unauthenticated attacker can crash the managesieve service or exhaust memory via crafted messages, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27858?
CVE-2026-27858 is a high-severity denial of service vulnerability in Dovecot Dovecot, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
Which versions are affected by CVE-2026-27858?
It affects 2 products.
Products include Dovecot Dovecot, Open-Xchange Dovecot.
How do I fix CVE-2026-27858?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-27858 being exploited?
There is no known exploitation of CVE-2026-27858 in the wild and no public exploit code.
Other vulnerabilities in Dovecot Dovecot
Sources
Also known as AZL-81710, CLSA-2026-1778172123, CLSA-2026-1778173027, CLSA-2026-1785836865, CLSA-2026-1786619512, CLSA-2026-1786675596 and 5 more.