Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-59045— Stalwart vulnerable to Memory Exhaustion via CalDAV Event Expansion

Quick assessment

Affected
stalwartlabs stalwart
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

stalwart是Stalwart Labs开源的一个多功能邮件和协作服务器。 stalwart 0.12.0至0.13.3之前版本存在安全漏洞，该漏洞源于CalDAV实现中存在内存耗尽问题，可能导致拒绝服务攻击。

AI Predicted 7.5 Difficulty: Easy EPSS 0.34% · P27

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-59045

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Stalwart vulnerable to Memory Exhaustion via CalDAV Event Expansion
Source: CVE Program / CVE List V5
Vulnerability Description
Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through recurring event expansion. An authenticated attacker can crash the Stalwart server by creating recurring events with large payloads and triggering their expansion through CalDAV REPORT requests. A single malicious request expanding 300 events with 1000-character descriptions can consume up to 2 GB of memory. The vulnerability exists in the `ArchivedCalendarEventData.expand` function, which processes CalDAV `REPORT` requests with event expansion. When a client requests recurring events in their expanded form using the `<C:expand>` element, the server stores all expanded event instances in memory without enforcing size limits. Users should upgrade to Stalwart version 0.13.3 or later to receive a fix. If immediate upgrading is not possible, implement memory limits at the container/system level; monitor server memory usage for unusual spikes; consider rate limiting CalDAV REPORT requests; and restrict CalDAV access to trusted users only.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
stalwart 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
stalwart是Stalwart Labs开源的一个多功能邮件和协作服务器。 stalwart 0.12.0至0.13.3之前版本存在安全漏洞，该漏洞源于CalDAV实现中存在内存耗尽问题，可能导致拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
stalwartlabs stalwart >= 0.12.0, < 0.13.3 -

II. Public POCs for CVE-2025-59045

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-59045

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-59045 (1)

IV. Related Vulnerabilities

Same product: stalwart
Same vendor: stalwartlabs
Same weakness: CWE-770

V. Comments for CVE-2025-59045

No comments yet

Leave a comment