← Back

CVE-2025-59028

nvd nist
Published: Mar 27, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.

Affected (2)

Dovecot
1 product
Dovecot
Open Xchange
1 product
Dovecot
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Dovecot
Before 2.4.3
Dovecot
Before 3.1.2

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (1)

Source: security@open-xchange.com
Vendor Advisory

Timeline

No history available yet.