CVE-2026-52681: Low severity vulnerability
Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. Both can cause degradation of service for mail delivery. Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version. No publicly available exploits are known.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs valid credentials and the ability to repeatedly change the active Sieve script. The issue is therefore relevant where authenticated users can manage Sieve scripts.
What impact should operators expect?
The configured Sieve CPU limit can be bypassed, enabling sustained CPU consumption that can degrade mail delivery. Compiled script files left behind after deletion or renaming can also increase disk consumption.
How can I detect possible exploitation or exposure?
Monitor systems for abnormal CPU usage and disk consumption, especially where users frequently change active Sieve scripts. Leftover compiled script files after scripts are deleted or renamed are an additional indicator.
What should be done if the issue is present?
Update to a non-vulnerable version. Until then, monitor CPU and disk consumption for degradation affecting mail delivery.