CVE-2025-59032: dovecot Improper Input Validation
Vulnerability summary
CVE-2025-59032 is a high (CVSS 7.5) Improper Input Validation vulnerability in dovecot. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 18 · Related 5Timeline
- 27-03-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.70% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-229Improper Handling of ValuesThe product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.
Affected systems
Debian1 product
- dovecot< 1:2.3.19.1+dfsg1-2.1+deb12u2 | < 1:2.4.1+dfsg1-6+deb13u4 | < 1:2.4.3+dfsg1-1
Dovecot1 product
- dovecot< 2.4.3
Open-xchange1 product
- dovecot< 3.1.3
Open-xchange gmbh1 product
- ox dovecot pro≤ 3.1.0 | ≤ 2.4.0
Ubuntu1 product
- dovecotAll versions (No fix recorded) | < 1:2.3.16+dfsg1-3ubuntu2.7 | < 1:2.3.21+dfsg1-2ubuntu6.3 | < 1:2.4.1+dfsg1-5ubuntu4.1
5 vendors · 5 products
