Описание
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lead to a denial of service, impacting Sieve script management and overall server availability.
Отчет
Red Hat Product Security rates this vulnerability as having an Important severity because unauthenticated remote attackers can exhaust host CPU resources without credentials, compromising server responsiveness. The impact is specifically confined to deployments where the ManageSieve protocol listener is enabled and reachable over the network. In standard Dovecot installations where ManageSieve is not enabled, or where access to the service port is restricted to trusted administrative networks, the risk of host-wide service disruption is substantially lowered.
Меры по смягчению последствий
Restrict network access to the ManageSieve service to trusted clients only. This can be accomplished by configuring a firewall to limit incoming connections to the port used by ManageSieve (typically 4190/tcp) from known, authorized IP addresses or subnets. This action reduces the attack surface by preventing untrusted remote access to the vulnerable service. A service restart or reload may be required for firewall changes to take full effect, depending on the firewall management tool used.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | dovecot | Out of support scope | ||
| Red Hat Enterprise Linux 7 | dovecot | Affected | ||
| Red Hat Enterprise Linux 10 | dovecot | Fixed | RHSA-2026:79371 | 08.10.2026 |
| Red Hat Enterprise Linux 8 | dovecot | Fixed | RHSA-2026:76763 | 06.10.2026 |
| Red Hat Enterprise Linux 9 | dovecot | Fixed | RHSA-2026:80825 | 12.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
An unauthenticated attacker can send a truncated quoted argument to th ...
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
EPSS
7.5 High
CVSS3