Medium [CVE-2026-40013] Denial of Service in ManageSieve service via crafted Sieve script
This medium-severity Red Hat Linux advisory covers CVE-2026-40013 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management.
This might be able to be used for remote code execution. Disable the ManageSieve service if users do not need remote Sieve script management.
Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot. This action triggers an out-of-bounds write during script compilation, leading to memory corruption and a crash of the ManageSieve process.
Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-787.
Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: dovecot.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 45 minutes ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 45 minutes ago·verify at source
Mitigation checklist
- To mitigate this issue, disable the ManageSieve service if remote Sieve script management is not required. This can typically be achieved by removing `sieve` from the `protocols` setting in your Dovecot configuration (e.g., in `/etc/dovecot/dovecot.conf` or a file in `/etc/dovecot/conf.d/`). For example, change `protocols = imap pop3 lmtp sieve` to `protocols = imap pop3 lmtp`. After modifying the configuration, the Dovecot service must be restarted for the changes to take effect using `systemctl restart dovecot`. Disabling this service will prevent users from remotely managing their Sieve scripts.
Official advisory · high-confidence parse· fetched 45 minutes ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.