CVE-2025-59028: Input Validation
When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59028?
CVE-2025-59028 has a severity rating of high with a score of 7.5.
How do I fix CVE-2025-59028?
To fix CVE-2025-59028, install the fixed version of Dovecot or disable concurrency in login processes.
What impact does CVE-2025-59028 have on my server?
CVE-2025-59028 can cause denial of service (DoS) by disconnecting active authentication sessions when invalid base64 SASL data is sent.
Which software is affected by CVE-2025-59028?
CVE-2025-59028 affects Dovecot and Open-Xchange Dovecot software.
What is the main issue caused by CVE-2025-59028?
The main issue caused by CVE-2025-59028 is that it results in the failure of all active authentication sessions due to invalid base64 SASL data.