CVE-2026-33605

A flaw was found in Dovecot. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. This can lead to a denial of service for Sieve script management, affecting either the attacker's connection or all connections handled by the same process, depending on the security mode.

This vulnerability is rated as Important because an unauthenticated remote attacker can crash the ManageSieve login daemon, causing a denial of service for mail filtering administration without requiring valid credentials. In standard Red Hat Enterprise Linux environments, the ManageSieve protocol is not enabled by default and runs isolated from primary IMAP and POP3 delivery processes. Consequently, systems that do not explicitly configure the Sieve protocol listener are not affected, and core mailbox operations remain fully functional even during an attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access to the ManageSieve service to trusted clients only. This can be achieved by configuring a firewall to limit incoming connections to the service's port (e.g., 4190 for Sieve) from specific IP addresses or networks. For example, using firewalld:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_NETWORK>" port port="4190" protocol="tcp" accept'
firewall-cmd --reload

Replace <TRUSTED_IP_OR_NETWORK> with the actual trusted source. A firewall reload is required for changes to take effect.