« Volver al listado

CVE-2025-59045

Estado: AplazadaAlta (7.1)—

Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through recurring event expansion. An authenticated attacker can crash the Stalwart server by creating recurring events with large payloads and triggering their expansion through CalDAV REPORT requests.

Leer descripción completaMostrar menos

A single malicious request expanding 300 events with 1000-character descriptions can consume up to 2 GB of memory. The vulnerability exists in the `ArchivedCalendarEventData.expand` function, which processes CalDAV `REPORT` requests with event expansion. When a client requests recurring events in their expanded form using the `<C:expand>` element, the server stores all expanded event instances in memory without enforcing size limits. Users should upgrade to Stalwart version 0.13.3 or later to receive a fix. If immediate upgrading is not possible, implement memory limits at the container/system level; monitor server memory usage for unusual spikes; consider rate limiting CalDAV REPORT requests; and restrict CalDAV access to trusted users only.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso autenticado a servicio remoto (PR:L) sin UI, con DoS por consumo de memoria en CalDAV REPORT. CWE-770 y expansión recursiva causan agotamiento de recursos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramPrivileged Account ManagementNetwork SegmentationFilter Network TrafficDisable or Remove Feature or Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Stalw — StalwartAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-59045",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59045",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-11T13:28:40.366420Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "stalwartlabs",
          "product": "stalwart",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.12.0, < 0.13.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-09-10T16:15:41.737",
  "references": [
    {
      "url": "https://github.com/stalwartlabs/stalwart/blob/main/CHANGELOG.md",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/stalwartlabs/stalwart/commit/15762fba2ba335e560b8d25f71af085a8b6b6cf2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/stalwartlabs/stalwart/releases/tag/v0.13.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-xv4r-q6gr-6pfg",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://tools.ietf.org/html/rfc4791",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through recurring event expansion. An authenticated attacker can crash the Stalwart server by creating recurring events with large payloads and triggering their expansion through CalDAV REPORT requests. A single malicious request expanding 300 events with 1000-character descriptions can consume up to 2 GB of memory. The vulnerability exists in the `ArchivedCalendarEventData.expand` function, which processes CalDAV `REPORT` requests with event expansion. When a client requests recurring events in their expanded form using the `<C:expand>` element, the server stores all expanded event instances in memory without enforcing size limits. Users should upgrade to Stalwart version 0.13.3 or later to receive a fix. If immediate upgrading is not possible, implement memory limits at the container/system level; monitor server memory usage for unusual spikes; consider rate limiting CalDAV REPORT requests; and restrict CalDAV access to trusted users only."
    },
    {
      "lang": "es",
      "value": "Stalwart es un servidor de correo y colaboración. A partir de la versión 0.12.0 y anterior a la versión 0.13.3, existe una vulnerabilidad de agotamiento de memoria en la implementación CalDAV de Stalwart que permite a atacantes autenticados causar denegación de servicio al desencadenar un consumo de memoria ilimitado mediante la expansión de eventos recurrentes. Un atacante autenticado puede bloquear el servidor Stalwart creando eventos recurrentes con grandes cargas útiles y desencadenando su expansión a través de solicitudes CalDAV REPORT. Una única solicitud maliciosa que expanda 300 eventos con descripciones de 1000 caracteres puede consumir hasta 2 GB de memoria. La vulnerabilidad existe en la función 'ArchivedCalendarEventData.expand', que procesa las solicitudes CalDAV 'REPORT' con expansión de eventos. Cuando un cliente solicita eventos recurrentes en su forma expandida utilizando el elemento 'C:expand', el servidor almacena todas las instancias de eventos expandidos en memoria sin aplicar límites de tamaño. Los usuarios deben actualizar a la versión 0.13.3 de Stalwart o posterior para recibir una solución. Si la actualización inmediata no es posible, implemente límites de memoria a nivel de contenedor/sistema; monitoree el uso de memoria del servidor en busca de picos inusuales; considere limitar la tasa de solicitudes CalDAV REPORT; y restrinja el acceso CalDAV solo a usuarios de confianza."
    }
  ],
  "lastModified": "2026-06-17T09:45:29.697",
  "sourceIdentifier": "security-advisories@github.com"
}