CVE-2026-33605: ManageSieve Login Process DoS Vulnerability

CVE-2026-33605 Overview

CVE-2026-33605 is a denial-of-service vulnerability affecting the Dovecot ManageSieve login service. An unauthenticated remote attacker can crash the managesieve-login process by sending a small malformed command before completing authentication. The impact depends on the deployment configuration. In high-security mode, the default for Dovecot community releases, only the attacker's own connection terminates. In high-performance mode, the default for Dovecot Pro releases, all connections handled by the same managesieve-login process terminate simultaneously. Repeated attacks disrupt Sieve script management for legitimate users. The issue is classified as [CWE-400] Uncontrolled Resource Consumption. No public exploits are known at time of publication.

Critical Impact
Unauthenticated network attackers can repeatedly crash the ManageSieve login process, denying Sieve script management to legitimate users in high-performance deployments.

Affected Products

Dovecot ManageSieve service (community releases)
Dovecot Pro ManageSieve service (high-performance mode default)
Open-Xchange Dovecot deployments per advisory OXDC-ADV-2026-0003

Discovery Timeline

2026-08-28 - CVE-2026-33605 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-33605

Vulnerability Analysis

The vulnerability resides in the managesieve-login process that handles pre-authentication protocol traffic for the ManageSieve service. ManageSieve, defined in RFC 5804, allows users to remotely manage Sieve mail filtering scripts. When the login process receives a specific malformed command sequence before authentication completes, the process crashes.

Dovecot supports two operational modes with different blast radii. High-security mode isolates each client connection in its own login worker, limiting a crash to the attacker's own session. High-performance mode multiplexes many client connections through a shared login process to reduce overhead, which turns a single crash into a service-wide disruption for every user assigned to that worker.

Because the flaw triggers before authentication, no credentials, session state, or user interaction are required. The attack requires only network reachability to the ManageSieve port, typically TCP 4190.

Root Cause

The root cause is improper handling of a malformed pre-authentication command in the ManageSieve login parser, resulting in uncontrolled resource consumption and process termination. The Open-Xchange advisory OXDC-ADV-2026-0003 documents the affected code path and fixed versions.

Attack Vector

Exploitation requires network access to the ManageSieve service. An attacker opens a TCP connection to the ManageSieve port and transmits a small malformed command before issuing AUTHENTICATE. The managesieve-login process crashes on receipt. In high-performance deployments, every concurrent client sharing that worker is disconnected. Scripted repetition sustains the denial of service and blocks Sieve script updates for all users behind the affected worker.

No verified exploit code is publicly available. Refer to the Open-Xchange Security Advisory OXDC-ADV-2026-0003 for authoritative technical detail.

Detection Methods for CVE-2026-33605

Indicators of Compromise

Repeated managesieve-login process crash entries or unexpected restarts in Dovecot service logs.
Clusters of TCP connections to port 4190 that close without completing an AUTHENTICATE exchange.
Sudden mass disconnection events across multiple ManageSieve clients sharing a login worker.

Detection Strategies

Alert on managesieve-login process termination or supervisor-driven restarts occurring outside maintenance windows.
Correlate short-lived pre-authentication ManageSieve sessions with subsequent login process failures.
Monitor connection error rates on TCP 4190 for anomalous spikes originating from single source addresses.

Monitoring Recommendations

Ingest Dovecot service logs and process supervisor events into a centralized logging platform for correlation.
Track baseline managesieve-login restart frequency and alert on deviations.
Instrument perimeter firewalls to log source addresses that establish and abandon ManageSieve sessions.

How to Mitigate CVE-2026-33605

Immediate Actions Required

Restrict network access to the ManageSieve service to trusted client networks using firewall or ACL rules.
Apply the vendor-supplied patched Dovecot release referenced in Open-Xchange advisory OXDC-ADV-2026-0003.
Audit whether the deployment runs in high-security or high-performance mode to assess exposure.
Review Dovecot service logs for prior managesieve-login crashes that may indicate opportunistic probing.

Patch Information

Open-Xchange has published fixed Dovecot releases in advisory OXDC-ADV-2026-0003. Administrators should update to the non-vulnerable versions identified in the Open-Xchange Security Advisory OXDC-ADV-2026-0003. No configuration change fully resolves the underlying parsing flaw without the patch.

Workarounds

Limit ManageSieve exposure to trusted internal networks or VPN clients until the patch is deployed.
Consider temporarily switching Dovecot Pro deployments from high-performance mode to high-security mode to contain crashes to individual connections.
Deploy rate limiting on TCP 4190 to slow repeated exploitation attempts from a single source.

bash

# Example: restrict ManageSieve (TCP 4190) to a trusted management subnet
iptables -A INPUT -p tcp --dport 4190 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4190 -j DROP