Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M
CVE-2026-26312Stalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messages
Medium 6.5
In plain English
A medium-severity resource allocation without limits in stalwart from stalwartlabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4 where accessing a specially crafted email containing malformed nested `message/rfc822` MIME parts via IMAP or JMAP causes excessive CPU and memory consumption, potentially leading to an out-of-memory condition and server crash. The malformed structure causes the `mail-parser` crate to produce cyclical references in its parsed representation, which Stalwart then follows indefinitely. Version 0.15.5 contains a patch.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| stalwartlabs | stalwart | >= 0.13.0, < 0.15.5 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-jm95-876q-c9gw x_refsource_CONFIRM