CVE-2026-27858

HIGH

7.5

CVSS Score

Published: March 27, 2026 at 08:10 AM UTC

Updated: October 26, 2026 at 09:10 PM UTC

3 products affected across 3 vendorsDovecotOX DovecotEnterprise Linux

Using OX Dovecot Pro by Open-Xchange GmbH?

Get instant alerts when new vulnerabilities affect OX Dovecot Pro - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Dovecot · Dovecot

95%

v < 2.4.3

Affected range stops below 2.4.3, so it looks safe — our inference, not a vendor statement

OX Dovecot · Open Xchange

95%

v < 2.3.22.13.0.0 ≤ v < 3.0.53.1.0 ≤ v < 3.1.4

Affected range stops below 2.3.22.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.0.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.1.4, so it looks safe — our inference, not a vendor statement

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 1:2.2.36-8.el7_9.1 (unaffected)

Vendor states this is fixed in 1:2.3.16-11.el9_4.2 (unaffected)

Vendor states this is fixed in 1:2.3.16-15.el9_6.1 (unaffected)

Vendor states this is fixed in 1:2.3.16-15.el9_7.1 (unaffected)

Vendor states this is fixed in 1:2.3.16-18.el9_8 (unaffected)

Vendor states this is fixed in 1:2.3.16-2.el8_6.1 (unaffected)

Vendor states this is fixed in 1:2.3.16-3.el8_8.1 (unaffected)

Vendor states this is fixed in 1:2.3.16-3.el9_0.1 (unaffected)

Vendor states this is fixed in 1:2.3.16-7.el8_10 (unaffected)

Vendor states this is fixed in 1:2.3.16-8.el9_2.2 (unaffected)

Vendor states this is fixed in 1:2.3.21-16.el10_0.1 (unaffected)

Vendor states this is fixed in 1:2.3.21-16.el10_1.1 (unaffected)

Vendor states this is fixed in 1:2.3.21-19.el10_2 (unaffected)

Vendor states this is fixed in 1:2.3.8-9.el8_4.1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json