PT-2026-20939 · Unknown · Mail-Parser+1

Proxforge · Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-26312

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Stalwart Mail Server versions 0.13.0 through 0.15.4

Description A denial-of-service condition exists in Stalwart Mail Server when processing specially crafted emails. Accessing an email with malformed nested message/rfc822 MIME parts through IMAP or JMAP can lead to excessive CPU and memory usage, potentially causing an out-of-memory condition and server crash. The issue stems from cyclical references created by the mail-parser crate during parsing, which Stalwart then indefinitely processes.

Recommendations Versions prior to 0.15.5 are affected. Update to version 0.15.5 or later to resolve this issue.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-26312

GHSA-JM95-876Q-C9GW

Affected Products

Stalwart Mail Server

Mail-Parser

References · 5

• 🔥 https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-jm95-876q-c9gw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26312.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-26312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26312 · Security Note
• https://t.me/CVEtracker/45177 · Telegram Post