A critical vulnerability in the Stalwart mail and collaboration server allows unauthenticated remote attackers to exhaust system memory and trigger a denial of service.

The software contains an unbounded memory allocation flaw within the IMAP protocol parser, specifically affecting the CommandParser implementation. Unauthenticated attackers can send specially crafted IMAP requests to trigger excessive memory consumption, leading to an out of memory condition.

This vulnerability poses a significant risk to business continuity by allowing remote, unauthenticated actors to crash core communication infrastructure. With a CVSS score of 7.5, the impact on service availability is high, as the denial of service can lead to extended downtime for mail and collaboration workflows, potentially disrupting internal and external operations.

Immediate Action: Update the Stalwart mail and collaboration server to version 0.13.4 or later immediately.

Proactive Monitoring: Monitor server memory utilization and IMAP connection logs for unusual spikes or patterns indicative of resource exhaustion attempts.

Compensating Controls: Implement strict network level rate limiting and connection monitoring to mitigate the frequency of malicious requests, though note that this does not fully remediate the underlying flaw.

Public Exploit Available: No confirmed public exploit exists in the provided data.

The risk of denial of service against critical messaging infrastructure necessitates immediate action. Security teams must prioritize upgrading to version 0.13.4 to resolve the underlying memory allocation defect, as existing network-level mitigations are insufficient to guarantee protection against this attack vector.