CVE-2026-40019

A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lead to a denial of service, impacting Sieve script management and overall server availability.

Red Hat Product Security rates this vulnerability as having an Important severity because unauthenticated remote attackers can exhaust host CPU resources without credentials, compromising server responsiveness. The impact is specifically confined to deployments where the ManageSieve protocol listener is enabled and reachable over the network. In standard Dovecot installations where ManageSieve is not enabled, or where access to the service port is restricted to trusted administrative networks, the risk of host-wide service disruption is substantially lowered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access to the ManageSieve service to trusted clients only. This can be accomplished by configuring a firewall to limit incoming connections to the port used by ManageSieve (typically 4190/tcp) from known, authorized IP addresses or subnets. This action reduces the attack surface by preventing untrusted remote access to the vulnerable service. A service restart or reload may be required for firewall changes to take full effect, depending on the firewall management tool used.