Vulnerability · Published Jul 5, 2025 · Assigned by mitre
CVE-2025-53603
High 7.5
In plain English
A high-severity null pointer dereference in SOPE from Alinto. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sope | 5.8.0-1+deb12u1 | DEBIAN-CVE-2025-53603 |
| Debian:12 | sope | 5.8.0-1+deb12u1 | DSA-5970-1 |
| Debian:13 | sope | 5.12.1-2 | DEBIAN-CVE-2025-53603 |
| Debian:14 | sope | 5.12.1-2 | DEBIAN-CVE-2025-53603 |
| Ubuntu:25.10 | sogo | no fix listed | UBUNTU-CVE-2025-53603 |
| Ubuntu:26.10 | sogo | no fix listed | UBUNTU-CVE-2025-53603 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/Alinto/sope/compare/SOGo-2.0.1...SOGo-2.0.2
- https://www.openwall.com/lists/oss-security/2025/07/02/3
- https://github.com/Alinto/sope/blob/3146fbdb6ff3314e37e5c3682deeeef7d0f32064/sope-core/NGExtensions/NGHashMap.m#L790
- https://github.com/Alinto/sope/pull/69
- https://github.com/Alinto/sope/commit/280104e45c20519ac4849ebf8bca114d91383543
- https://lists.debian.org/debian-lts-announce/2025/08/msg00001.html
- http://www.openwall.com/lists/oss-security/2025/07/05/1