CVE-2025-59028

🔶 medium

Summary

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.

CVSS Score

5.3

Medium

EPSS Score

0.1

Exploit Probability

Published Date

2026-03-27

First Seen: 2026-03-28

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 19.8% of all 321,566 vulnerabilities in our database.

#257,788

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Mar 27, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-04-30

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE IDs (Weakness Types)

CWE-20

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
dovecot	dovecot	Affected	< 2.4.3

🔗 References 1

https://documentation.open-xchange.com/dovecot/secur...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-27851	⚠️ high	7.4	0.0	When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted...	2026-05-12
CVE-2026-33603	🔶 medium	6.8	0.0	Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This ...	2026-05-12
CVE-2026-40016	🔶 medium	5.3	0.0	Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits ...	2026-05-12
CVE-2026-40020	ℹ️ low	3.1	0.0	Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_all...	2026-05-12
CVE-2026-42006	🔶 medium	4.3	0.0	An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomple...	2026-05-12
CVE-2025-59032	⚠️ high	7.5	0.1	ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSi...	2026-03-27

These CVEs affect the same products