ManageSieve AUTHENTICATE command can crash when a literal SASL initial response is used. This results in the ManageSieve service becoming unavailable, denying legitimate users access to mailbox management functions. The flaw is an input validation error (CWE‑20) that allows an attacker to cause a crash by sending a specially crafted request.

The vulnerability affects Open-Xchange GmbH’s OX Dovecot Pro. Specific affected versions are not listed in the advisory, so all versions prior to the fixed release should be considered vulnerable until an update is applied.

The CVSS score of 7.5 indicates high severity. No public exploits are known and the EPSS score is unavailable, suggesting a moderate likelihood of exploitation. The attack requires network access to the ManageSieve port (typically 4190) and the ability to send a crafted AUTHENTICATE command. Because the issue leads to a crash rather than unauthorized data access, the primary risk is availability disruption; confidentiality and integrity remain unchanged.