This vulnerability allows an attacker to send a specially crafted message before authenticating to the managesieve service, causing the server to allocate an excessive amount of memory. The result is a denial‑of‑service condition, either by exhausting system resources or by crashing the managesieve‑login process. The weakness exemplifies uncontrolled resource consumption (CWE‑400).

The vulnerable product is Open‑Xchange GmbH’s OX Dovecot Pro. No specific version information is provided in the CNA data, so users should verify whether their deployment includes the impacted managesieve implementation.

The CVSS score of 7.5 indicates high severity. No EPSS data or KEV listing is available, and no public exploits are known. Nevertheless, an attacker only needs to send a crafted message over the network before authentication, making the threat vector remote and potentially reachable from any host with connectivity to the managesieve service.