CVE-2026-40016

A flaw was found in Dovecot. A remote or local attacker could upload a malicious Sieve script through the ManageSieve service, or locally, to bypass configured CPU time limits for Sieve scripts. This allows the attacker to consume excessive server resources, leading to a degradation of server performance and a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict access to the ManageSieve service to trusted users or networks. If the ManageSieve service is not essential, consider disabling it. Additionally, ensure that local user access to Sieve script directories is appropriately controlled. Any changes to Dovecot configuration may require a service reload or restart, potentially causing a brief interruption to mail services.