When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 27, 2026 · NIST NVD

   Detected

   When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.

2. Oct 7, 2026 · NIST NVD

   Updated

   When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). No publicly available exploits are known.

Affected

• cpe dovecot/dovecotversion unspecified
• cpe open-xchange/dovecotversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-59028

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-59028

  When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in lo

  nvd.nist.gov

References

• Vendor Advisory · documentation.open-xchange.com