CVE-2026-27858
Full vulnerability record from the local CVENow database.
Description
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-03-27 09:16:20.073000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-27858",
"sourceIdentifier": "[email protected]",
"published": "2026-03-27T09:16:20.073",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.\r\n Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known."
},
{
"lang": "es",
"value": "El atacante puede enviar un mensaje específicamente diseñado antes de la autenticación que provoca que managesieve asigne una gran cantidad de memoria. El atacante puede forzar que managesieve-login quede no disponible al bloquear repetidamente el proceso. Proteja el acceso al protocolo managesieve, o instale la versión corregida. No se conocen exploits disponibles públicamente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Open-Xchange GmbH",
"product": "OX Dovecot Pro",
"defaultStatus": "unaffected",
"modules": [
"core"
],
"versions": [
{
"version": "0",
"lessThanOrEqual": "2.3.0",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThanOrEqual": "3.1.0",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThanOrEqual": "2.4.0",
"versionType": "semver",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1",
"cpe:/o:redhat:enterprise_linux:10.2"
],
"versions": [
{
"version": "1:2.3.21-16.el10_1.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
},
{
"version": "1:2.3.21-19.el10_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"versions": [
{
"version": "1:2.3.21-16.el10_0.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"versions": [
{
"version": "1:2.2.36-8.el7_9.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"versions": [
{
"version": "1:2.3.16-7.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4"
],
"versions": [
{
"version": "1:2.3.8-9.el8_4.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4"
],
"versions": [
{
"version": "1:2.3.8-9.el8_4.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6"
],
"versions": [
{
"version": "1:2.3.16-2.el8_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_tus:8.6"
],
"versions": [
{
"version": "1:2.3.16-2.el8_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.6"
],
"versions": [
{
"version": "1:2.3.16-2.el8_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"versions": [
{
"version": "1:2.3.16-3.el8_8.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"versions": [
{
"version": "1:2.3.16-3.el8_8.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"versions": [
{
"version": "1:2.3.16-15.el9_7.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
},
{
"version": "1:2.3.16-18.el9_8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0"
],
"versions": [
{
"version": "1:2.3.16-3.el9_0.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"versions": [
{
"version": "1:2.3.16-8.el9_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"versions": [
{
"version": "1:2.3.16-11.el9_4.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"versions": [
{
"version": "1:2.3.16-15.el9_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-03-27T12:36:26.526829Z",
"id": "CVE-2026-27858",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.3",
"matchCriteriaId": "BE209329-C5EA-4EE7-A23E-CD2EC061A9A4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*",
"versionEndExcluding": "2.3.22.1",
"matchCriteriaId": "5CF82590-D98A-4E06-AC8C-6CC3506ED923"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.0.5",
"matchCriteriaId": "8476287B-40B2-4533-A3AB-B880516C0B5C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*",
"versionStartIncluding": "3.1.0",
"versionEndExcluding": "3.1.4",
"matchCriteriaId": "11CA35AA-72CB-4614-A064-8A90F65D8A71"
}
]
}
]
}
],
"references": [
{
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13498",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13830",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13857",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:17602",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:17625",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:17626",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:17628",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:17630",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18053",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19149",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19364",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19453",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19455",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26564",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-27858",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452175",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27858.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}