Description

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. Both can cause degradation of service for mail delivery. Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-28T12:16:30.010Z",
  "pubdate": "2026-08-28T12:16:30.010Z",
  "executiveSummary": "This vulnerability involves a resource management flaw within the Sieve script processing engine, enabling an authenticated attacker to bypass enforced CPU usage limits and induce disk exhaustion. The issue stems from the mechanism used to track CPU consumption, which is tied to the lifecycle of the compiled script. By repeatedly modifying or cycling the active Sieve script, an attacker can reset the internal accounting counters, effectively circumventing configured throttling policies. Furthermore, the system fails to purge compiled script artifacts upon script deletion or renaming, leading to uncontrolled accumulation of temporary files on the storage layer. The primary impact is a Denial of Service (DoS) condition manifested through sustained excessive CPU utilization and unauthorized disk space consumption, which degrades overall mail delivery performance. Exploitation requires valid user credentials to interact with the Sieve management interface. No public exploits are currently documented, but the potential for resource exhaustion requires immediate attention through administrative monitoring and software updates.",
  "technicalDetails": "The vulnerability resides in the Sieve processing engine's resource tracking architecture. In a standard deployment, the system maintains a CPU quota for user-defined Sieve scripts to prevent resource starvation. The accounting mechanism is implemented such that resource usage metrics are reset or reinitialized whenever the active script is updated, modified, or cycled. An attacker possessing valid authentication can abuse this behavior by programmatically forcing the application to re-compile or switch to a new active script, thereby resetting the CPU quota before the limit is reached. This enables a cyclic pattern of execution where the script constantly operates under the threshold, resulting in sustained, high-intensity CPU consumption despite security policies intended to cap such activity.\nParallel to the CPU bypass, the storage subsystem exhibits a critical flaw regarding object lifecycle management. When a user deletes or renames a Sieve script, the underlying compiled binary files are not purged from the server's filesystem. These orphaned artifacts persist indefinitely, consuming storage capacity. Through repeated script manipulation, an attacker can intentionally trigger the creation of numerous compiled script files, eventually exhausting available disk space or exceeding inode limits on the host partition.\nThe attack flow follows a structured progression: First, the attacker authenticates to the mail system using valid credentials. Second, the attacker uploads or replaces an active Sieve script. Third, they execute a script that performs resource-intensive operations designed to stress the CPU. Fourth, before the Sieve engine registers that the quota has been met, the attacker sends a command to update or toggle the script state, which clears the existing CPU usage counters. By automating this loop, the attacker maintains a persistent high CPU load. Concurrently, the process of repeatedly creating, renaming, or deleting these scripts leaves behind abandoned compiled binaries, leading to rapid disk space consumption. The combination of these two vectors results in an effective service degradation or a complete outage for mail delivery services relying on the Sieve processing engine."
}