CVE-2025-59028CWE-20

CVE-2025-59028

Medium · published March 27, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-03-27T13:16Z
Affected products (2)
ProductVersionsFixed in
dovecot/dovecot< 2.4.32.4.3
open-xchange/dovecot< 3.1.23.1.2
References (1)
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json · [email protected]
EPSS history
Timeline
  • 27 MAR 08:10Z
    When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail
    cvelistv5