CVE-2025-53603: Alinto SOPE SOGo DoS Vulnerability

CVE-2025-53603 Overview

CVE-2025-53603 is a null pointer dereference vulnerability in Alinto SOPE, the Objective-C web application framework underlying the SOGo groupware server. The flaw resides in sope-core/NGExtensions/NGHashMap.m and affects SOGo versions 2.0.2 through 5.12.2. An unauthenticated remote attacker can crash the SOGo service by sending a crafted HTTP request that includes a query string parameter with the same name as a parameter in the POST body. The duplicate-key handling path inside NGHashMap triggers a NULL dereference, terminating the worker process and producing a denial-of-service condition against mail and calendaring users.

Critical Impact

Unauthenticated remote attackers can crash SOGo with a single malformed HTTP request, disrupting webmail, calendar, and address-book services for all users.

Affected Products

• Alinto SOPE / SOGo 2.0.2 through 5.12.2
• Debian LTS packages bundling vulnerable SOPE/SOGo releases
• Downstream distributions shipping SOGo groupware before the patched commit

Discovery Timeline

• 2025-07-02 - Issue discussed on the Openwall oss-security mailing list
• 2025-07-05 - CVE-2025-53603 published to NVD
• 2025-08 - Debian LTS announcement released addressing the vulnerability
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-53603

Vulnerability Analysis

SOPE parses incoming HTTP requests and stores parameter values inside an NGHashMap structure that supports multiple values per key via a linked list (LList). When a parameter appears in both the URL query string and the POST body, SOPE attempts to insert a duplicate key into an existing list. The internal copy routine in NGHashMap.m failed to keep the list root and its last pointer consistent during this operation. Subsequent traversal dereferenced an uninitialized or NULL next pointer, segfaulting the SOGo worker [CWE-476]. Because SOGo runs as a long-lived multithreaded daemon, the crash terminates active sessions for all connected users.

Root Cause

The defect lies in the NGHashMap initializer that copies an existing hash map. The root of the linked list was not tracked separately from the iteration cursor, so when a duplicate key was added the structure was left with an inconsistent tail. Walking the list later dereferenced a pointer that was never set, producing the NULL pointer dereference.

Attack Vector

The vulnerability is reachable over the network without authentication or user interaction. An attacker submits an HTTP POST request to any SOGo endpoint that accepts form parameters, while supplying the same parameter name in the URL query string. SOPE merges the two sources into NGHashMap, hits the inconsistent state, and crashes. No special privileges, tokens, or prior session are required.

// Patch from sope-core/NGExtensions/NGHashMap.m
// NGHashMap: keep root->last consistent to fix segfault
// adding duplicate key after copy
   NSEnumerator *keys    = nil;
   id            key     = nil;
   LList *list    = NULL;
+  LList *root    = NULL;
   LList *newList = NULL;
   LList *oldList = NULL;

   if ((self = [self initWithCapacity:[_hashMap count]])) {
     keys  = [_hashMap keyEnumerator];
     while ((key = [keys nextObject])) {
       list           = [_hashMap __structForKey:key];
-      newList        = initLListElement(list->object,NULL);
+      root = newList = initLListElement(list->object,NULL);
       newList->count = list->count;
       NSMapInsert(self->table,key,newList);
       while (list->next) {

Source: Alinto SOPE commit 280104e

Detection Methods for CVE-2025-53603

Indicators of Compromise

• SOGo worker processes terminating with SIGSEGV and core dumps referencing NGHashMap.m
• Repeated 5xx responses or abrupt connection resets following requests with overlapping query and body parameter names
• Spikes in sogod restarts logged by systemd or the supervising init system

Detection Strategies

• Inspect web server and reverse proxy logs (Apache, Nginx) for POST requests where the query string repeats parameter names also present in the body
• Alert on segmentation faults in sogod via journald, dmesg, or crash reporters such as ABRT
• Correlate SOGo service restarts with inbound HTTP traffic patterns to identify external triggering

Monitoring Recommendations

• Forward sogod and reverse proxy logs to a centralized SIEM and build identifications around repeated crashes from the same source IP
• Track availability of SOGo HTTP endpoints with synthetic monitoring to surface DoS conditions quickly
• Enable rate limiting and anomalous-request alerting at the reverse proxy in front of SOGo

How to Mitigate CVE-2025-53603

Immediate Actions Required

• Upgrade Alinto SOPE/SOGo to a release that incorporates commit 280104e45c20519ac4849ebf8bca114d91383543 or later
• Apply Debian LTS or distribution-supplied security updates referenced in the August 2025 Debian LTS announcement
• Restrict exposure of SOGo to trusted networks or VPN until patches are deployed

Patch Information

The fix is committed upstream in the Alinto SOPE repository and ensures the NGHashMap copy constructor maintains a consistent root pointer when duplicate keys are inserted. See the GitHub commit log, the pull request discussion, and the Debian LTS announcement for distribution-specific package versions.

Workarounds

• Deploy a reverse proxy rule that rejects requests where a query string parameter name is duplicated in the POST body
• Apply web application firewall signatures to drop or normalize requests with conflicting parameter sources
• Limit SOGo accessibility to authenticated VPN users where feasible until the patched package is installed

# Example Nginx snippet to drop suspicious requests with overlapping
# query and body parameters (adapt parameter names as needed)
map $request_method$arg_username $sogo_block {
    default              0;
    "~^POST"             1;
}

server {
    listen 443 ssl;
    server_name sogo.example.com;

    location /SOGo/ {
        if ($sogo_block) {
            return 400;
        }
        proxy_pass http://127.0.0.1:20000;
    }
}