An attacker can upload a malicious Sieve script through the ManageSieve service or via local access, allowing the script to run up to 130 times the configured CPU time limit. This bypass enables the attacker to consume excessive server CPU resources, degrading performance and potentially causing a denial of service. No publicly available exploits are known, but the vulnerability permits a direct means to impair system stability.

The issue affects Open‑Xchange GmbH’s OX Dovecot Pro product, specifically the ManageSieve component that processes Sieve scripts. Version details are not supplied, so any deployment of this product is potentially impacted.

With a CVSS score of 5.3 the vulnerability is moderate; the EPSS score is not available, so the likely exploitation frequency cannot be quantified. It is not listed in the CISA KEV catalog. An attack would require the ability to upload a Sieve script, which can be achieved via the public ManageSieve interface or by local file access. The attacker’s script can then consume more CPU time than permitted, leading to measurable performance degradation.