CVE-2025-61600
BaseFortify
Publication date: 2025-10-02
Last updated on: 2025-10-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| stalwartlabs | stalwart | 0.13.4 |
| stalwartlabs | stalwart | 0.13.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-789 | The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. |
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Stalwart mail and collaboration server versions 0.13.3 and below. It is an unbounded memory allocation issue in the IMAP protocol parser, where certain parsing states do not enforce size limits on dynamic buffers. This allows remote attackers to cause the server to allocate excessive memory, potentially exhausting system memory and triggering the out-of-memory (OOM) killer, leading to a denial of service.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing remote attackers to exhaust the server's memory resources, causing the system to run out of memory and potentially crash or become unresponsive. This results in a denial of service, disrupting mail and collaboration services provided by the Stalwart server.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Stalwart to version 0.13.4 or later where the issue is fixed. As a workaround, implement rate limiting and connection monitoring at the network level to reduce the risk of exploitation, although this does not provide complete protection.