A crafted message sent before authentication causes the managesieve component of OX Dovecot Pro to allocate excessive memory, leading the process to crash. The vulnerability is a classic denial‑of‑service flaw that results in the managesieve‑login service becoming unavailable, preventing legitimate users from accessing mail services while the service is unstable. The weakness is identified as improper resource management and memory allocation errors.

The affected product is Open‑Xchange GmbH’s OX Dovecot Pro, which incorporates the Dovecot mail server’s managesieve support. No specific version numbers are supplied in the advisory; users should verify that their installation includes the managesieve component and inspect the release notes for the applicable version.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation, yet the flaw remains actionable. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by sending a specially crafted managesieve request over the network before authentication. No publicly available exploits are known, but the operation is straightforward for an attacker who can reach the managesieve port.