Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1570 advisory.

    Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An     attacker can use this to determine the configured credentials. Figuring out the credential will lead into     full access to the affected component. Limit access to the doveadm http service port, install fixed     version. No publicly available exploits are known. (CVE-2026-27856)

    Sending NOOP (((...))) command with 4000 parenthesis open+close results in ~1MB extra memory usage.
    Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time     periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and     create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and     killing the process and its other proxied connections. Attacker could connect possibly from even a single     IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit     and killing the process and its other proxied connections. Install fixed version, there is no other     remediation. No publicly available exploits are known. (CVE-2026-27857)

    Attacker can send a specifically crafted message before authentication that causes managesieve to allocate     large amount of memory.Attacker can force managesieve-login to be unavailable by repeatedly crashing the     process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits     are known. (CVE-2026-27858)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6197 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6197-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 05, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : dovecot     CVE ID         : CVE-2025-59031 CVE-2025-59032 CVE-2026-27855                      CVE-2026-27856 CVE-2026-27857 CVE-2026-27858                      CVE-2026-27859 CVE-2026-59028 CVE-2026-24031                      CVE-2026-27860 CVE-2026-0394

    Multiple vulnerabilities have been discovered in the Dovecot IMAP server     which way result in denial of service, SQL injection, path traversal,     replay attacks or timing side channel attacks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1:2.3.19.1+dfsg1-2.1+deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 1:2.4.1+dfsg1-6+deb13u4.

    We recommend that you upgrade your dovecot packages.

    For the detailed security status of dovecot please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dovecot

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8136-1 advisory.

    It was discovered that Dovecot incorrectly handled invalid base64 SASL data. An attacker could possibly     use this issue to cause a denial of service. This issue only affected Ubuntu 25.10. (CVE-2025-59028)

    It was discovered that Dovecot script decode2text.sh incorrectly handled zip files. An attacker could     possibly use this issue to obtain sensitive information. (CVE-2025-59031)

    It was discovered that Dovecot incorrectly handled certain AUTHENTICATE requests. An attacker could     possibly use this issue to cause a denial of service. (CVE-2025-59032)

    It was discovered that Dovecot incorrectly handled certain SQL based authentication. An attacker could     possibly use this issue to bypass authentication. This issue only affected Ubuntu 25.10. (CVE-2026-24031)

    It was discovered that Dovecot incorrectly handled certain LDAP based authentication. An attacker could     possibly use this issue to bypass restrictions and allow probing of LDAP structure. This issue only     affected Ubuntu 25.10. (CVE-2026-27860)

    It was discovered that Dovecot is vulnerable to replay attack under certain conditions. An attacker could     possibly use this issue to bypass authentication. (CVE-2026-27855)

    It was discovered that Dovecot is vulnerable to a timing attack under certain conditions. An attacker     could possibly use this issue to bypass authentication. (CVE-2026-27856)

    It was discovered that Dovecot incorrectly handled certain IMAP login requests. An attacker could possibly     use this issue to cause a denial of service. (CVE-2026-27857)

    It was discovered that Dovecot incorrectly handled certain specially crafted messages. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-27858)

    It was discovered that Dovecot incorrectly handled certain specially crafted mail messages. An attacker     could possibly use this issue to cause a denial of service. (CVE-2026-27859)

    It was discovered that Dovecot incorrectly handles file paths. A attacker could possibly use this issue to     perform a path traversal and obtain or modify arbitrary files. This issue only affected Ubuntu 22.04 LTS     and Ubuntu 24.04 LTS. (CVE-2026-0394)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Attacker can send a specifically crafted message before authentication that causes managesieve to allocate     large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the     process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits     are known. (CVE-2026-27858)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306220	Amazon Linux 2023 : dovecot, dovecot-devel, dovecot-mysql (ALAS2023-2026-1570)	Nessus	Amazon Linux Local Security Checks	high
305037	Debian dsa-6197 : dovecot-auth-lua - security update	Nessus	Debian Local Security Checks	high
304437	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : Dovecot vulnerabilities (USN-8136-1)	Nessus	Ubuntu Local Security Checks	high
304117	Linux Distros Unpatched Vulnerability : CVE-2026-27858	Nessus	Misc.	high

Detections

Analytics

CVE-2026-27858

high

Tenable Plugins

high

high

high

high