What is the CVSS score of CVE-2025-61600?

CVE-2025-61600 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Debian are affected by CVE-2025-61600?

Stalwart mail server versions 0.13.3 and earlier contain an unbounded memory allocation flaw in IMAP parsing that allows remote attackers to trigger denial of service by exhausting server memory.. A patch is available.

How to fix or mitigate CVE-2025-61600?

Within 24 hours: Identify all Stalwart instances and document current versions (0.13.3 or below are affected). Within 7 days: Apply vendor patch to upgrade Stalwart to version 0.13.4 or later on all affected systems. Within 30 days: Verify patch deployment across all production and non-production Stalwart infrastructure and validate IMAP protocol functionality post-upgrade.

Debian CVE-2025-61600

EUVD-2025-33212 HIGH

Uncontrolled Resource Consumption (CWE-400)

2025-10-02 security-advisories@github.com

Denial Of Service Debian

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:26 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.13.4

EUVD ID Assigned

Mar 13, 2026 - 19:12 euvd

EUVD-2025-33212

Analysis Generated

Mar 13, 2026 - 19:12 vuln.today

CVE Published

Oct 02, 2025 - 22:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which allows remote attackers to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The CommandParser implementation enforces size limits on its dynamic buffer in most parsing states, but several state handlers omit these validation checks. This issue is fixed in version 0.13.4. A workaround for this issue is to implement rate limiting and connection monitoring at the network level, however this does not provide complete protection.

Analysis

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400).