PT-2025-40430 · Stalwart · Stalwart

B0-N0-B0 + 1 · Published 2025-10-02 · Updated 2025-10-07 · CVE-2025-61600

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Stalwart versions 0.13.3 and below

Description Stalwart, a mail and collaboration server, has an issue where the IMAP protocol parser can allocate an unlimited amount of memory. This can allow a remote attacker to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The CommandParser implementation generally limits the size of its dynamic buffer during parsing, but some state handlers do not perform these validation checks.

Recommendations Update to version 0.13.4 or later. Implement rate limiting and connection monitoring at the network level as a workaround.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-789

CWE-400

Related Identifiers

CVE-2025-61600

GHSA-8JQJ-QJ5P-V5RR

Affected Products

Stalwart

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61600.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61600 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61600 · Vendor Advisory
• https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-8jqj-qj5p-v5rr · Note
• https://github.com/stalwartlabs/stalwart/releases/tag/v0.13.4 · Note
• https://github.com/stalwartlabs/stalwart/commit/a8e631e881bded8128358732f18e02ca94a4e677 · Note
• https://reddit.com/r/stalwartlabs/comments/1o0fo1j/security_at_the_core_stalwart_completes_second · Reddit Post
• https://t.me/CVEtracker/33984 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1973903681285177389 · Twitter Post
• https://twitter.com/CVEnew/status/1973868266184667307 · Twitter Post