CVE-2026-40016
Description
Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2026-40016.html
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2026-40016
Vendor advisory: security@open-xchange.com — https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | affected | |
| debian | bullseye | affected | |
| debian | forky | fixed | 1:2.4.4+dfsg1-1 |
| debian | sid | fixed | 1:2.4.4+dfsg1-1 |
| debian | trixie | affected | |
| sles | affected | |
References
CWEs
CWE-400
Verify integrity in audit chain (admin only). AS-IS.