CVE-2026-40016

{
  "id": "CVE-2026-40016",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T14:17:03.570",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known."
    },
    {
      "lang": "es",
      "value": "El atacante puede cargar un script Sieve malicioso a través del servicio ManageSieve (o localmente) para eludir los límites de tiempo de CPU configurados para Sieve hasta 130 veces el límite configurado. El atacante puede usar esto para degradar el rendimiento del servidor y eludir los límites de tiempo de CPU configurados para los scripts Sieve. Instale la versión corregida o, alternativamente, impida el acceso directo a los scripts Sieve a través de ManageSieve o acceso local. No se conocen exploits disponibles públicamente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Open-Xchange GmbH",
          "product": "OX Dovecot Pro",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T15:38:37.399932Z",
          "id": "CVE-2026-40016",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.4.4",
              "matchCriteriaId": "86CE1F3B-DF73-431A-9EC0-491E8969A187"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*",
              "versionEndExcluding": "3.1.5",
              "matchCriteriaId": "28C2DD58-A4B0-4F2C-BC60-F30F380251BC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}