Read the docs
TI-2026-21268 Aliases CVE-2026-26312

Stalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messages

Priority LOW 29CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a specially crafted email containing malformed nested `message/rfc822` MIME parts via IMAP or JMAP causes excessive CPU and memory consumption, potentially leading to an out-of-memory condition and server crash. The malformed structure causes the `mail-parser` crate to produce cyclical references in its parsed representation, which Stalwart then follows indefinitely. Version 0.15.5 contains a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0041 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed stalwart (stalwartlabs): 0.15.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
stalwartlabsstalwart0.13.0 to before 0.15.50.15.5Patch availableCNA
  • stalwart Vendorstalwartlabs Affected 0.13.0 to before 0.15.5 Fixed in 0.15.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:stalw:stalwart:*:*:*:*:*:*:*:*0.13.0 to before 0.15.5VulnerableStalw
  • cpe:2.3:a:stalw:stalwart:*:*:*:*:*:*:*:* Versions 0.13.0 to before 0.15.5 Vulnerable ·Stalw

Remediation

  • Fix · CNA stalwart (stalwartlabs) Fixed in 0.15.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26312

References

Exploit 1

  • TI-2024-23261 Stalwart Mail Server has privilege escalation by design CVSS 3.1CRITICAL 9.1
  • TI-2026-56046 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri CVSS 4.0HIGH 8.5
  • TI-2024-23253 Unprivileged Stalwart Mail Server user can read files as root CVSS 3.1MEDIUM 6.8
  • TI-2025-38045 Unbounded Memory Allocation in Stalwart IMAP parser CVSS 3.1HIGH 7.5
  • TI-2025-36687 Stalwart vulnerable to Memory Exhaustion via CalDAV Event Expansion CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences