CVE-2026-33605: High severity Dovecot ManageSieve vulnerability
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the ManageSieve service to trusted clients (limit who can reach the ManageSieve port).
- Operational
Update to a non-vulnerable version of the ManageSieve software (specific fixed version not provided in the supplied text).
Event History
Frequently Asked Questions
Which deployments face service-wide disruption rather than loss of only the attacker's session?
Deployments using high-performance mode are affected service-wide: every connection handled by the same managesieve-login process is terminated. This mode is the default for Pro releases; high-security mode, the default for community releases, terminates only the attacker's connection.
Does exploitation require credentials or user interaction?
No. An unauthenticated attacker can trigger the issue remotely by sending a small malformed command before authentication, with no user interaction required.
What can be done while waiting to update?
Restrict network access to the ManageSieve service to trusted clients. This reduces exposure to unauthenticated attackers who can reach the login process.
What operational symptom would indicate attempted exploitation?
Repeated termination of ManageSieve connections, particularly all connections sharing a managesieve-login process in high-performance mode, is consistent with exploitation attempts. The issue can be repeated to deny access to Sieve script management.