CVE-2025-61600: Unbounded Memory Allocation in Stalwart IMAP parser
Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which allows remote attackers to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The CommandParser implementation enforces size limits on its dynamic buffer in most parsing states, but several state handlers omit these validation checks. This issue is fixed in version 0.13.4. A workaround for this issue is to implement rate limiting and connection monitoring at the network level, however this does not provide complete protection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Stalwartto a version that resolves this vulnerability.Fixed in 0.13.4 - Compensating control
Implement rate limiting and connection monitoring at the network level.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61600?
CVE-2025-61600 is a critical vulnerability that can lead to unbounded memory allocation, causing server outages.
How do I fix CVE-2025-61600?
To mitigate CVE-2025-61600, upgrade to Stalwart Mail and Collaboration Server version 0.13.4 or later.
Who is affected by CVE-2025-61600?
CVE-2025-61600 affects all versions of Stalwart Mail and Collaboration Server up to and including 0.13.3.
What type of vulnerability is CVE-2025-61600?
CVE-2025-61600 is classified as an unbounded memory allocation vulnerability in the IMAP protocol parser.
Can CVE-2025-61600 be exploited remotely?
Yes, CVE-2025-61600 can be exploited by remote attackers to exhaust server memory.