CVE-2026-40019: open-xchange gmbh ox dovecot ce Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-40019 is a medium (CVSS 5.9) Uncontrolled Resource Consumption vulnerability in open-xchange gmbh ox dovecot ce. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 3Timeline
- 28-08-2026PublishedVulnerability first disclosed.
- 28-08-2026Last modifiedVulnerability information updated.
Description
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
+0.06 pp
From 0.32% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- dovecot< 2.4.5-r0
Debian1 product
- dovecot< 1:2.4.5+dfsg1-1
Open-xchange gmbh1 product
- ox dovecot ce≥ 2.4.3, < 2.4.5
Ubuntu1 product
- dovecotAll versions (No fix recorded)
4 vendors · 4 products
