CVE-2017-15132
dovecot: Auth leaks memory if SASL authentication is aborted
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · January 9, 2018
Updated · November 22, 2025
Description
Aborting the process of SASL authentication can lead to a memory leak when the same login processes are reused. An attacker could use this flaw to cause a denial of service due to memory exhaustion.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
This issue can be mitigated on vulnerable systems by limiting the login process to a single request per process, which is also the default value.
CVSS / CWE
CVSS 3.0 · 5.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-400 · Uncontrolled Resource Consumption