CVE-2026-40019

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1

Description An unauthenticated attacker can cause a denial of service by sending a truncated quoted argument to the ManageSieve login process. This action triggers an infinite loop that consumes CPU resources, leading to the degradation of Sieve script management or a complete server crash if repeated connections are made.

Recommendations Update to version 2.4.5-1.1. Monitor the system for abnormal CPU usage and terminate the offending process. Restrict network access to the ManageSieve service to trusted clients.