CVE-2026-26312— Stalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messages
Quick assessment
Affected
stalwartlabs stalwart
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Stalwart Mail Server是Stalwart实验室的一体化邮件服务器。 Stalwart Mail Server 0.13.0版本至0.15.4版本存在安全漏洞，该漏洞源于处理包含畸形嵌套message/rfc822 MIME部分的特制电子邮件时，可能导致CPU和内存消耗过高，引发内存不足和服务器崩溃。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-26312
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messages
Source: CVE Program / CVE List V5
Vulnerability Description
Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a specially crafted email containing malformed nested `message/rfc822` MIME parts via IMAP or JMAP causes excessive CPU and memory consumption, potentially leading to an out-of-memory condition and server crash. The malformed structure causes the `mail-parser` crate to produce cyclical references in its parsed representation, which Stalwart then follows indefinitely. Version 0.15.5 contains a patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
Stalwart Mail Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Stalwart Mail Server是Stalwart实验室的一体化邮件服务器。 Stalwart Mail Server 0.13.0版本至0.15.4版本存在安全漏洞，该漏洞源于处理包含畸形嵌套message/rfc822 MIME部分的特制电子邮件时，可能导致CPU和内存消耗过高，引发内存不足和服务器崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| stalwartlabs | stalwart | >= 0.13.0, < 0.15.5 | - |
|
II. Public POCs for CVE-2026-26312
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-26312
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: stalwartlabs
-
CVE-2026-81036
Stalwart Mail Server through 0.16.19 Authorization Code Disc -
CVE-2025-61600
Unbounded Memory Allocation in Stalwart IMAP parser -
CVE-2025-59045
Stalwart vulnerable to Memory Exhaustion via CalDAV Event Ex -
CVE-2024-35187
Stalwart Mail Server has privilege escalation by design -
CVE-2024-35179
Unprivileged Stalwart Mail Server user can read files as roo
Same weakness: CWE-770
-
CVE-2026-97873
Legacy PBES1 and PKCS#12 PBE iteration count honoured unboun -
CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length i -
CVE-2026-66054
Apache Thrift: C++ THeaderTransport does not enforce configu -
CVE-2026-61374
Apache Thrift: Java TSaslTransport post-auth data-frame miss -
CVE-2026-63772
Apache Thrift: Unauthenticated single-packet crash of Go Thr
V. Comments for CVE-2026-26312
No comments yet