Unbounded Memory Allocation in Stalwart IMAP parser

published 2025-10-02 13 mo ago modified 2026-10-12 28 d ago also EUVD-2025-33212

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits: 0; none known

Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which allows remote attackers to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The CommandParser implementation enforces size limits on its dynamic buffer in most parsing states, but several state handlers omit these validation checks. This issue is fixed in version 0.13.4. A workaround for this issue is to implement rate limiting and connection monitoring at the network level, however this does not provide complete protection.

Patch / fix

fixed in 1 links 2

stalw stalwart 0.13.4

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 13 mo ago (2025-10-03)

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

stalwartlabs stalwart

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-789 Memory Allocation with Excessive Size Value

References

Sources

CVE List CVE-2025-61600
NVD CVE-2025-61600

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary