An unauthenticated attacker can crash the managesieve service in OX Dovecot Pro by sending crafted messages that trigger excessive memory allocation.

This vulnerability, classified as CWE-400 (Uncontrolled Resource Consumption), allows an unauthenticated attacker to exhaust system memory and repeatedly crash the managesieve-login process. The flaw is triggered by sending a specially crafted message before the authentication phase is completed.

The exploitation of this vulnerability results in a denial of service, rendering the managesieve protocol unavailable to legitimate users. With a CVSS score of 7.5, this high-severity flaw threatens operational continuity and service availability for mail management infrastructures. Organizations relying on this service may experience significant disruption to email configuration and management workflows.

Immediate Action: Restrict network access to the managesieve protocol to trusted sources only and apply the latest security updates provided by Open-Xchange GmbH as they become available.

Proactive Monitoring: Monitor system logs for repeated connection attempts to the managesieve port, especially those originating from untrusted IP addresses, and watch for sudden spikes in memory consumption.

Compensating Controls: Deploy firewall rules or access control lists to limit exposure of the managesieve service to authorized internal networks, effectively reducing the attack surface.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for service disruption, administrators must prioritize restricting access to the affected managesieve service. Apply vendor-provided patches as soon as they are released to permanently address the memory allocation flaw and restore service integrity.