CVE-2026-33605

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1

Description An unauthenticated attacker can cause a denial of service for Sieve script management by sending a small malformed command before authentication, which crashes the ManageSieve login process. The impact depends on the operating mode: in high-security mode, only the attacker's connection is terminated, whereas in high-performance mode, all connections handled by the same managesieve-login process are terminated.

Recommendations Update to version 2.4.5-1.1. Restrict network access to the ManageSieve service to trusted clients.