PT-2025-40430 · Stalwart · Stalwart

B0-N0-B0 + 1 · Publicado 2025-10-02 · Atualizado 2025-10-07 · CVE-2025-61600

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Stalwart versions 0.13.3 and below

Description Stalwart, a mail and collaboration server, has an issue where the IMAP protocol parser can allocate an unlimited amount of memory. This can allow a remote attacker to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The CommandParser implementation generally limits the size of its dynamic buffer during parsing, but some state handlers do not perform these validation checks.

Recommendations Update to version 0.13.4 or later. Implement rate limiting and connection monitoring at the network level as a workaround.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-789

CWE-400

Identificadores relacionados

CVE-2025-61600

GHSA-8JQJ-QJ5P-V5RR

Produtos afetados

Stalwart

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61600.json · Exploit
• https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-8jqj-qj5p-v5rr · Nota
• https://github.com/stalwartlabs/stalwart/releases/tag/v0.13.4 · Nota
• https://github.com/stalwartlabs/stalwart/commit/a8e631e881bded8128358732f18e02ca94a4e677 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-61600 · Nota de Segurança
• https://reddit.com/r/stalwartlabs/comments/1o0fo1j/security_at_the_core_stalwart_completes_second · Publicação no Reddit
• https://t.me/CVEtracker/33984 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1973903681285177389 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1973868266184667307 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-61600 · Aviso do Fabricante