CVE-2026-27858

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-278595.3A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message ca CVE-2026-27869.8Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thun CVE-2026-278605.3If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially CVE-2026-278674.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who h CVE-2026-278686.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) wh CVE-2026-278696.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) wh CVE-2026-27879.8Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8 CVE-2026-278704.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who h CVE-2026-278712.9Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue af CVE-2026-278725.6- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.CVE-2026-278735.6- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before CVE-2026-278745.0: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. T