CVE-2025-61600

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-61600
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61600.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-61600
Aliases
  • GHSA-8jqj-qj5p-v5rr
Published
2025-10-02T21:30:52Z
Modified
2026-08-12T03:51:13Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Unbounded Memory Allocation in Stalwart IMAP parser
Details

Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which allows remote attackers to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The CommandParser implementation enforces size limits on its dynamic buffer in most parsing states, but several state handlers omit these validation checks. This issue is fixed in version 0.13.4. A workaround for this issue is to implement rate limiting and connection monitoring at the network level, however this does not provide complete protection.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61600.json"
}
References

Affected packages

Git / github.com/stalwartlabs/stalwart

Affected ranges

Type
GIT
Repo
https://github.com/stalwartlabs/stalwart
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a8e631e881bded8128358732f18e02ca94a4e677
Fixed
b39b4ec141ba2f9e7728e9261541d2b9af536453
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.13.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.10.6
v0.10.7
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.11.6
v0.11.7
v0.11.8
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.12.4
v0.12.5
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.3.0
v0.3.1
v0.3.10
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.6.0
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61600.json"