CVE-2026-40019: Medium severity vulnerability
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the ManageSieve service to trusted clients only.
- Operational
Monitor the system for abnormal CPU usage and kill the offending process that is spinning due to the truncated quoted argument ManageSieve login loop.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network client that can connect to the ManageSieve login service can attempt exploitation. Restricting ManageSieve network access to trusted clients reduces exposure.
What does an attacker need to send?
The attacker must send a truncated quoted argument to the ManageSieve login process. The attack complexity is rated high, and no authentication or user interaction is required.
What is the operational impact?
The affected login process can enter an infinite loop and consume CPU. Repeated connections may consume all available server CPU, degrading or denying Sieve script management.
What can be done before updating?
Monitor systems for abnormal CPU usage and kill the offending process if detected. Limit network access to the ManageSieve service to trusted clients until a non-vulnerable version can be deployed.
Are public exploits known?
No publicly available exploits are known.