CVE-2026-27858: Dovecot

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Affected products

• Dovecot Dovecot: before 2.4.3 (fixed in 2.4.3)
• Open-Xchange Dovecot: before 2.3.22.1 (fixed in 2.3.22.1); from 3.0.0, before 3.0.5 (fixed in 3.0.5); from 3.1.0, before 3.1.4 (fixed in 3.1.4)

Published 2026-03-27. Last modified 2026-07-15.