CVE-2025-57798
Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input
Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerability in the title input functionality due to a lack of proper length validation. This flaw allows an attacker to cause an Out Of Memory (OOM) error and subsequent program termination by inserting an excessively long string into a note's title. This can be triggered either through direct user interface (UI) input or programmatically via the local web service API after compromising an authentication token. There are 2 primary methods of exploitation: via User Interface (UI) Input, and the Local Web Service API. A local user can directly type or paste an extremely long string into the title field when creating or editing a note Joplin runs a local web service (typically on port 41184) that allows programmatic interaction, such as creating or editing notes via HTTP API calls. If an attacker manages to exfiltrate or compromise the user's authentication token (e.g., through malware on the local system, or other local vulnerabilities), they can then send a crafted HTTP POST request to this local API. By including an excessively long string in the title parameter of this request, the application will attempt to allocate an unbounded amount of memory. This issue has been patched in version 3.7.1.
INFO
Published Date :
May 19, 2026, 9:16 p.m.
Last Modified :
July 24, 2026, 9:10 a.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update Joplin to version 3.7.1 or later.
- Validate all input length for note titles.
- Secure local web service API authentication tokens.
- Apply security patches promptly.
Public PoC/Exploit Available at Github
CVE-2025-57798 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-57798.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-57798 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-57798
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Config files for my GitHub profile.
config github-config
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-57798 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-57798 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 24, 2026
Action Type Old Value New Value Added Translation Title: joplin de laurent22, Description: Joplin es una aplicación de código abierto para tomar notas y tareas pendientes que organiza notas y listas en cuadernos. Las versiones 3.6.14 y anteriores contienen una vulnerabilidad de Denegación de Servicio (DoS) en la funcionalidad de entrada del título debido a una falta de validación de longitud adecuada. Esta falla permite a un atacante causar un error de falta de memoria (OOM) y la terminación subsiguiente del programa al insertar una cadena excesivamente larga en el título de una nota. Esto puede ser activado ya sea a través de la entrada directa de la interfaz de usuario (UI) o programáticamente a través de la API del servicio web local después de comprometer un token de autenticación. Hay 2 métodos principales de explotación: a través de la Entrada de Interfaz de Usuario (UI), y la API del Servicio Web Local. Un usuario local puede escribir o pegar directamente una cadena extremadamente larga en el campo del título al crear o editar una nota. Joplin ejecuta un servicio web local (típicamente en el puerto 41184) que permite la interacción programática, como crear o editar notas a través de llamadas a la API HTTP. Si un atacante logra exfiltrar o comprometer el token de autenticación del usuario (por ejemplo, a través de malware en el sistema local, u otras vulnerabilidades locales), entonces puede enviar una solicitud HTTP POST manipulada a esta API local. Al incluir una cadena excesivamente larga en el parámetro del título de esta solicitud, la aplicación intentará asignar una cantidad ilimitada de memoria. Este problema ha sido parcheado en la versión 3.7.1. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'laurent22', 'product': 'joplin', 'versions': [{'status': 'affected', 'version': '< 3.7.1'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-57798', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-05-20T14:54:42.424880Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 20, 2026
Action Type Old Value New Value Added Reference https://github.com/laurent22/joplin/security/advisories/GHSA-6jm8-gr87-q69x -
New CVE Received by [email protected]
May. 19, 2026
Action Type Old Value New Value Added Description Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerability in the title input functionality due to a lack of proper length validation. This flaw allows an attacker to cause an Out Of Memory (OOM) error and subsequent program termination by inserting an excessively long string into a note's title. This can be triggered either through direct user interface (UI) input or programmatically via the local web service API after compromising an authentication token. There are 2 primary methods of exploitation: via User Interface (UI) Input, and the Local Web Service API. A local user can directly type or paste an extremely long string into the title field when creating or editing a note Joplin runs a local web service (typically on port 41184) that allows programmatic interaction, such as creating or editing notes via HTTP API calls. If an attacker manages to exfiltrate or compromise the user's authentication token (e.g., through malware on the local system, or other local vulnerabilities), they can then send a crafted HTTP POST request to this local API. By including an excessively long string in the title parameter of this request, the application will attempt to allocate an unbounded amount of memory. This issue has been patched in version 3.7.1. Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-770 Added Reference https://github.com/laurent22/joplin/commit/5b8795da446a5a40c9e212c98b35e368ffce628e Added Reference https://github.com/laurent22/joplin/security/advisories/GHSA-6jm8-gr87-q69x