Improper input validation in Dovecot and OX Dovecot Pro - CVE-2025-59028
Published: April 1, 2026
Vulnerability identifier: #VU124721
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-59028
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in SASL authentication handling when processing user-supplied data. A remote attacker can send a specially crafted request containing invalid base64 data to cause a denial of service.
The denial of service affects concurrent authentication sessions.
Affected software
Dovecot
OX Dovecot Pro
Ubuntu
dovecot (Ubuntu package)
OX Dovecot Pro
Ubuntu
dovecot (Ubuntu package)
How to mitigate CVE-2025-59028
Install security update from vendor's website.
Dovecot - update to 2.4.3
OX Dovecot Pro - update to 3.1.2
dovecot (Ubuntu package) - addressed in versions 1:2.3.16+dfsg1-3ubuntu2.7, 1:2.3.16+dfsg1-3ubuntu2.8, 1:2.3.21+dfsg1-2ubuntu6.3, 1:2.3.21+dfsg1-2ubuntu6.4, 1:2.4.1+dfsg1-5ubuntu4.1
OX Dovecot Pro - update to 3.1.2
dovecot (Ubuntu package) - addressed in versions 1:2.3.16+dfsg1-3ubuntu2.7, 1:2.3.16+dfsg1-3ubuntu2.8, 1:2.3.21+dfsg1-2ubuntu6.3, 1:2.3.21+dfsg1-2ubuntu6.4, 1:2.4.1+dfsg1-5ubuntu4.1