PT-2026-42012 · Joplin · Joplin

Published 2026-05-19 · Updated 2026-05-20 · CVE-2025-57798

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.7.1

Description A Denial of Service (DoS) issue exists in the title input functionality due to missing length validation. An attacker can cause an Out Of Memory (OOM) error—a state where the system cannot allocate enough memory to perform an operation—leading to program termination by inserting an excessively long string into a note title. This can be achieved through the user interface or programmatically via the local web service API if an authentication token is compromised. Specifically, a crafted HTTP POST request sent to the local API containing an excessively long string in the title parameter causes the application to attempt an unbounded memory allocation.

Recommendations Update to version 3.7.1.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-57798

Affected Products

Joplin

References · 6

• 🔥 https://github.com/laurent22/joplin/security/advisories/GHSA-6jm8-gr87-q69x · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57798 · Security Note
• https://github.com/laurent22/joplin/commit/5b8795da446a5a40c9e212c98b35e368ffce628e · Note
• https://twitter.com/VulmonFeeds/status/2056868375381303485 · Twitter Post
• https://twitter.com/CVEnew/status/2056870181704499358 · Twitter Post
• https://t.me/cveNotify/164265 · Telegram Post