Technical impact
The vulnerability occurs when an IMAP/SMTP client sends SASL authentication data that is not valid base64. This causes the authentication process to be disconnected from the authentication server, which in turn terminates all currently active authentication sessions. The result is a denial of service that disrupts concurrent logins to the server; legitimate users cannot authenticate while the server is in this disjoint state. The weakness involves improper handling of base64 decoding and insecure reliance on malformed input, aligning with CWE‑1286 (Container Format Parsing Errors) and CWE‑20 (Improper Input Validation).
Affected Systems
The affected product is Open‑Xchange GmbH’s OX Dovecot Pro. No specific version ranges are supplied in the CNA data; administrators should verify the version of OX Dovecot Pro they are running against the vendor’s advisory for confirmation.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, and the EPSS score is less than 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exposures arise through normal network connections to the IMAP/SMTP interfaces when a client submits malformed SASL data; however, no publicly available exploits have been reported, so the attack is primarily a crafted DoS scenario rather than a remote code execution.
Ubuntu USN