CVE-2026-40016

Description

Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

No configuration data available.

未在提供的文本中指定，请参考官方公告 oxdc-adv-2026-0002.json

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Sample Sieve script for testing CPU limit bypass
# This is a conceptual PoC for CVE-2026-40016
require ["fileinto", "variables"];

# Attacker attempts to trigger the bypass
if size :over 1K {
    set "flag" "1";
    # Logic intended to consume CPU beyond configured limits
    fileinto "TargetFolder";
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-40016
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-40016
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-40016/
[4] VulDB https://vuldb.com/cve/CVE-2026-40016
[5] https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-40016", "sourceIdentifier": "[email protected]", "published": "2026-05-12T14:17:03.570", "lastModified": "2026-05-12T15:08:22.857", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-400"}]}], "references": [{"url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json", "source": "[email protected]"}]}}