CVE-2026-40016 Denial of service in OX Dovecot Pro
Attackers can bypass Sieve CPU time limits via malicious scripts, degrading server performance and causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40016?
CVE-2026-40016 is a medium-severity denial of service vulnerability in Dovecot Dovecot, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known.
Weakness: CWE-400
Which versions are affected by CVE-2026-40016?
It affects 2 products.
Linux distribution packages (1)
dovecot22 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.2.31-19.43.1 |
Products include Dovecot Dovecot, Open-Xchange Dovecot.
How do I fix CVE-2026-40016?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-40016 being exploited?
There is no known exploitation of CVE-2026-40016 in the wild and no public exploit code.
Other vulnerabilities in Dovecot Dovecot
Sources
Also known as ALPINE-CVE-2026-40016, AZL-86805, DEBIAN-CVE-2026-40016, GHSA-m97m-74mq-mqc6, SUSE-SU-2026:4271-1, UBUNTU-CVE-2026-40016.