CVE-2026-33605

CVE-2026-33605 is an unauthenticated denial-of-service vulnerability (CWE-400) in the ManageSieve login process of Dovecot, assigned by Open-Xchange. A remote attacker who can reach the ManageSieve service crashes it by sending a small malformed command before authenticating, requiring no credentials or user interaction. In high-security mode (the default for community releases) only the attacker's own connection is terminated, but in high-performance mode (the default for Pro releases) all connections handled by the same managesieve-login process are terminated, so repeated requests can sustain a denial of service against Sieve script management. Any deployment exposing the ManageSieve service to untrusted networks is affected, with the greatest impact on Pro installations running in high-performance mode. No public proof-of-concept, public exploit, or in-the-wild exploitation is known; EPSS is 0.4% (31st percentile) and the flaw is not in CISA KEV.

What to do: Restrict network access to the ManageSieve service (typically TCP port 4190) to trusted clients and upgrade Dovecot to a non-vulnerable version per the Open-Xchange advisory; the source data does not list exact fixed version numbers, so verify against the vendor's published update. Dovecot Pro operators running in high-performance mode should prioritize patching because one crash drops every connection on the shared process, and should check logs for repeated managesieve-login crash/restart loops.