Resource exhaustion in Dovecot and OX Dovecot Pro - CVE-2026-40016

Vulnerability identifier: #VU131866

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-40016

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the Sieve substring matching implementation when processing a malicious Sieve script. A remote user can upload a malicious Sieve script to cause a denial of service.

The script can be uploaded over the ManageSieve service or through local access, and the issue can bypass configured CPU time limits for Sieve by up to 130 times.

Dovecot
OX Dovecot Pro
Debian Linux
openEuler
Ubuntu
dovecot (Ubuntu package)
dovecot (Debian package)
dovecot
dovecot-debuginfo
dovecot-debugsource
dovecot-devel
dovecot-help

Install security update from vendor's website.

Dovecot - update to 2.4.4
OX Dovecot Pro - update to 3.1.5
dovecot (Ubuntu package) - addressed in versions 1:2.3.16+dfsg1-3ubuntu2.9, 1:2.3.21+dfsg1-2ubuntu6.5, 1:2.4.1+dfsg1-5ubuntu4.2, 1:2.4.2+dfsg1-3ubuntu2.1
dovecot (Debian package) - addressed in versions 1:2.3.19.1+dfsg1-2.1+deb12u6, 1:2.4.1+dfsg1-6+deb13u6
dovecot - update to 2.3.20-5
dovecot-debuginfo - update to 2.3.20-5
dovecot-debugsource - update to 2.3.20-5
dovecot-devel - update to 2.3.20-5
dovecot-help - update to 2.3.20-5

• https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0002.html

• Multiple vulnerabilities in Dovecot
• Debian update for dovecot
• Ubuntu update for dovecot
• openEuler update for dovecot