CVE-2025-59045: Stalwart CalDAV DoS Vulnerability

CVE-2025-59045 Overview

CVE-2025-59045 is a memory exhaustion vulnerability in Stalwart, an open-source mail and collaboration server. The flaw affects versions starting at 0.12.0 and prior to 0.13.3. An authenticated attacker can crash the server by sending CalDAV REPORT requests that expand recurring calendar events without server-side size limits. A single request expanding 300 events with 1000-character descriptions can consume up to 2 GB of memory. The vulnerability is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
A single authenticated CalDAV REPORT request can exhaust server memory and trigger a denial-of-service condition, disrupting mail and collaboration services for all users.

Affected Products

Stalwart mail and collaboration server version 0.12.0
Stalwart versions 0.12.x through 0.13.2
Stalwart CalDAV implementation in ArchivedCalendarEventData.expand

Discovery Timeline

2025-09-10 - CVE-2025-59045 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59045

Vulnerability Analysis

The vulnerability resides in Stalwart's CalDAV implementation, specifically in the ArchivedCalendarEventData.expand function. RFC 4791 defines the CalDAV <C:expand> element to let clients request recurring events expanded into individual instances. Stalwart processes this expansion in memory and stores every generated instance without enforcing an upper bound. An attacker who controls a calendar can create recurring events with oversized properties such as long descriptions. When the attacker subsequently issues a CalDAV REPORT request asking for expansion, the server allocates memory proportional to instances multiplied by payload size. Tests show 300 events with 1000-character descriptions reach 2 GB of resident memory in a single request. Repeated requests escalate consumption until the operating system terminates the process or other services fail.

Root Cause

The serialize_ical function generated expanded iCalendar output without an instance counter or memory ceiling. The patched version introduces an instances_limit parameter that is decremented for each instance and short-circuits expansion when the budget is exhausted.

Attack Vector

Exploitation requires valid CalDAV credentials but no special privileges. The attacker uploads a recurring event with a wide recurrence rule and large textual fields, then issues a CalDAV REPORT containing <C:expand> over a long time range. The server attempts to materialize every occurrence in memory before returning the response.

rust

         is_all || matches_one
     }
 
-    pub fn serialize_ical(&mut self, event: &ArchivedCalendarEvent, data: &CalendarData) -> String {
+    pub fn serialize_ical(
+        &mut self,
+        event: &ArchivedCalendarEvent,
+        data: &CalendarData,
+        instances_limit: &mut usize,
+    ) -> Option<String> {
         let mut out = String::with_capacity(event.size.to_native() as usize);
         let _v = [0.into()];
         let mut component_iter: Iter<'_, rkyv::rend::u16_le> = _v.iter();

Source: Stalwart Labs Commit Details. The patch changes the function signature to accept and decrement an instances_limit, returning Option<String> so callers can abort serialization safely.

Detection Methods for CVE-2025-59045

Indicators of Compromise

Sustained Stalwart process memory growth following CalDAV REPORT requests containing the <C:expand> element
Out-of-memory (OOM) kills of the Stalwart server process in system logs such as dmesg or journalctl
HTTP REPORT requests targeting /dav/calendar/ endpoints from a single authenticated user in rapid succession
Creation of recurring calendar events with unusually large DESCRIPTION fields or unbounded RRULE values

Detection Strategies

Inspect CalDAV access logs for REPORT method requests with bodies containing <C:expand> or urn:ietf:params:xml:ns:caldav:expand references
Correlate per-user request rates against server memory utilization metrics to surface single-user resource spikes
Alert on Stalwart child processes whose resident set size exceeds a baseline threshold within short time windows

Monitoring Recommendations

Export Stalwart process metrics to a centralized observability platform and set alerts on RSS growth rate
Enable verbose CalDAV request logging and forward logs to a SIEM for retention and correlation
Track authentication events for accounts performing repeated calendar event creation followed by REPORT queries

How to Mitigate CVE-2025-59045

Immediate Actions Required

Upgrade Stalwart to version 0.13.3 or later, which enforces an instance limit during CalDAV expansion
Audit existing calendars for recurring events with oversized DESCRIPTION fields or open-ended RRULE values and remove them
Restrict CalDAV access to trusted authenticated users until the upgrade is complete

Patch Information

The fix is published in Stalwart Labs Release v0.13.3. The relevant code change is documented in the Stalwart Labs Commit Details and the GitHub Security Advisory GHSA-xv4r-q6gr-6pfg. Background on the CalDAV <C:expand> element is available in the RFC 4791 Specification.

Workarounds

Apply memory limits to the Stalwart process at the container or systemd level using MemoryMax or Docker --memory flags
Configure a reverse proxy or web application firewall to rate-limit CalDAV REPORT requests per authenticated user
Temporarily disable the CalDAV <C:expand> feature at the proxy layer by blocking request bodies that contain the element

bash

# Example systemd drop-in to cap Stalwart memory usage
# /etc/systemd/system/stalwart-mail.service.d/limits.conf
[Service]
MemoryMax=1G
MemoryHigh=768M
TasksMax=512

# Example nginx rate limit for CalDAV REPORT requests
limit_req_zone $remote_user zone=caldav_report:10m rate=5r/m;
location /dav/ {
    limit_except GET HEAD PROPFIND { limit_req zone=caldav_report burst=3 nodelay; }
    proxy_pass http://stalwart_backend;
}