High severity · published Mar 27, 2026
CVE-2025-59032
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
OX Dovecot Pro · Open-Xchange GmbH
through 3.1.0; through 2.4.0 · source: vendor
DO
Dovecot · Dovecot
before 2.4.3 · source: NVD
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.6 Telecommunications Update Service · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59032
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59032
Vendor Advisory
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:13498
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:13830
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:13857
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:17602
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:17625
More from OX Dovecot Pro
9.1
CVE-2026-42007
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents…
9.1
CVE-2026-27851
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped
8.2
CVE-2026-24031
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin
7.5
CVE-2026-42391
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately
7.5
CVE-2026-33605
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating