CVE-2025-59032 | BDVDB-2026-323296 Detail
Open-XchangeOX Dovecot Pro
Description#
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
References#
- https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json
- https://access.redhat.com/security/cve/CVE-2025-59032
- https://bugzilla.redhat.com/show_bug.cgi?id=2452172
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59032.json
- https://access.redhat.com/errata/RHSA-2026:26564
- https://access.redhat.com/errata/RHSA-2026:17602
- https://access.redhat.com/errata/RHSA-2026:13498
- https://access.redhat.com/errata/RHSA-2026:19149
- https://access.redhat.com/errata/RHSA-2026:13830
- https://access.redhat.com/errata/RHSA-2026:19455
- https://access.redhat.com/errata/RHSA-2026:19453
- https://access.redhat.com/errata/RHSA-2026:18053
- https://access.redhat.com/errata/RHSA-2026:17630
- https://access.redhat.com/errata/RHSA-2026:17628
- https://access.redhat.com/errata/RHSA-2026:17625
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.