The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular e…

published 2021-06-28 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-20684

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.0%; EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits: 0; none known

The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.

Patch / fix

fixed in 1 distros 5

dovecot dovecot 2.3.15

debian suse opensuse azure linux arch linux

dovecot Debian 14, Debian 13, Debian 12 1:2.3.16+dfsg1-1

debian advisories DEBIAN-CVE-2020-28200

dovecot23 SLE Module for Server Applications 15 SP3, SLE Module for Server Applications 15 SP2 2.3.15-58.3
dovecot23 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +6 more 2.3.15-27.3
dovecot23 SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 2.3.15-4.38.3

suse advisories SUSE-SU-2021:2892-1 SUSE-SU-2021:2891-1 SUSE-SU-2021:2890-1

dovecot24 openSUSE Tumbleweed 2.4.0-1.1
dovecot23 openSUSE Tumbleweed 2.3.16-1.6
dovecot23 openSUSE Leap 15.2 2.3.15-lp152.2.12.1
dovecot23 openSUSE Leap 15.3 2.3.15-58.3

opensuse advisories openSUSE-SU-2025:14715-1 openSUSE-SU-2024:10726-1 openSUSE-SU-2021:1225-1 openSUSE-SU-2021:2892-1

dovecot CBL-Mariner 2.0 2.3.20-1

azure linux advisories AZL-7194

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

pigeonhole Arch Linux 0.5.15-1

arch linux advisories AVG-2088

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-28200 updated 2026-11-07 cvss 4.3

dovecot: insufficient protection against excessive resource usage allows for a DoS

Red Hat Enterprise Linux 6 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole Red Hat Enterprise Linux 8 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux 9 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole
affected: no fix available

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.97% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:L/S:U/UI:N
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
vendor-advisory
dovecot.org /security
vendor-advisory
openwall.com /lists/oss-security/2021/06/28/3
mailing-list, third-party-advisory

Sources

CVE List CVE-2020-28200
NVD CVE-2020-28200

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary