CVE-2026-27858: High severity Dovecot Dovecot ManageSieve vulnerability
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Protect access to the managesieve protocol (limit/restrict who can reach managesieve).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27858?
CVE-2026-27858 has a high severity due to its potential to crash the managesieve service and cause denial of service.
How do I fix CVE-2026-27858?
To fix CVE-2026-27858, install the updated version of Dovecot ManageSieve that addresses this vulnerability.
Which software is affected by CVE-2026-27858?
CVE-2026-27858 specifically affects Dovecot ManageSieve implementations.
What impact does CVE-2026-27858 have on users?
CVE-2026-27858 can lead to denial of service, making managesieve unavailable for legitimate users.
How can I protect against CVE-2026-27858?
You can protect against CVE-2026-27858 by restricting access to the managesieve protocol until an update is applied.