An attacker can upload a malicious Sieve script through the ManageSieve service or via local access, allowing the script to run up to 130 times the configured CPU time limit. This flaw represents a classic instance of resource exhaustion (CWE-400) and system resource exhaustion (CWE-770), enabling the attacker to consume excessive server CPU resources, degrade performance, and potentially cause a denial of service. No publicly available exploits are known, but the vulnerability permits a direct means to impair system stability. The likelihood of a denial of service is inferred from the potential for excessive CPU consumption, though it is not explicitly stated in the CVE description.

The issue affects Open‑Xchange GmbH’s OX Dovecot Pro product, specifically the ManageSieve component that processes Sieve scripts. Version details are not supplied, so any deployment of this product is potentially impacted.

With a CVSS score of 5.3 the vulnerability is moderate; the EPSS score of 0.00016 is very low, indicating a minimal probability of exploitation. It is not listed in the CISA KEV catalog. An attack would require the ability to upload a Sieve script, which can be achieved via the public ManageSieve interface or by local file access. The attacker’s script can then consume more CPU time than permitted, leading to measurable performance degradation.