Yüksek CVSS 7.5
CVE-2026-27858: Dovecot: denetimsiz kaynak tüketimi
Açıklama (NVD)
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
Özet bilgiler
- Ürün
- Dovecot Dovecot
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- %0,80 (yüzdelik 57)
- CWE
- CWE-400
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| dovecot-dovecot | — | — | 2.4.3 |
| open-xchange-dovecot | — | — | 2.3.22.1 |
| open-xchange-dovecot | 3.0.0 | — | 3.0.5 |
| open-xchange-dovecot | 3.1.0 | — | 3.1.4 |
Kaynaklar
- NVD kaydı
- documentation.open-xchange.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- security.access.redhat.com
- CWE-400