Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-59028

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to Do

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OX

Description

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Open-Xchange GmbH OX Dovecot Pro

Default version status: unaffected

  • 0 to ≤ 3.1.0affected
  • 0 to ≤ 2.4.0affected

References