{"id":"CVE-2025-57798","summary":"Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input","details":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerability in the title input functionality due to a lack of proper length validation. This flaw allows an attacker to cause an Out Of Memory (OOM) error and subsequent program termination by inserting an excessively long string into a note's title. This can be triggered either through direct user interface (UI) input or programmatically via the local web service API after compromising an authentication token. There are 2 primary methods of exploitation: via User Interface (UI) Input, and the Local Web Service API. A local user can directly type or paste an extremely long string into the title field when creating or editing a note Joplin runs a local web service (typically on port 41184) that allows programmatic interaction, such as creating or editing notes via HTTP API calls. If an attacker manages to exfiltrate or compromise the user's authentication token (e.g., through malware on the local system, or other local vulnerabilities), they can then send a crafted HTTP POST request to this local API. By including an excessively long string in the title parameter of this request, the application will attempt to allocate an unbounded amount of memory. This issue has been patched in version 3.7.1.","aliases":["GHSA-6jm8-gr87-q69x"],"modified":"2026-07-15T01:49:20.046641640Z","published":"2026-05-19T20:24:35.088Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57798.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57798.json"},{"type":"ADVISORY","url":"https://github.com/laurent22/joplin/security/advisories/GHSA-6jm8-gr87-q69x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57798"},{"type":"FIX","url":"https://github.com/laurent22/joplin/commit/5b8795da446a5a40c9e212c98b35e368ffce628e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/laurent22/joplin","events":[{"introduced":"0"},{"fixed":"5b8795da446a5a40c9e212c98b35e368ffce628e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.7.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v3.7.1","v3.6.12","android-v3.6.17","v3.6.10","server-v3.6.1","android-v3.6.16","v3.6.9","v3.6.8","ios-v13.6.4","android-v3.6.15","v3.6.7","v3.6.6","ios-v13.6.3","android-v3.6.14","v3.6.5","v3.6.4","android-v3.6.13","v3.6.3","transcribe-v3.6.6","transcribe-v3.6.5","transcribe-v3.6.3","transcribe-v3.6.2","transcribe-v3.6.1","android-v3.6.12","v3.6.2","v3.6.1","ios-v13.5.2","android-v3.5.7","v3.5.10","android-v3.5.6","android-v3.5.5","android-v3.5.4","server-v3.5.2","android-v3.5.3","server-v3.5.1","ios-v13.5.1","v3.5.9","v3.5.7","v3.5.6","plugin-repo-cli-v3.5.3","cli-v3.5.1","v3.5.5","plugin-repo-cli-v3.5.1","plugin-generator-v3.5.1","v3.5.4","v3.5.3","v3.5.2","v3.5.1","server-v3.4.4","server-v3.4.3","cli-v3.4.1","ios-v13.4.2","android-v3.4.5","v3.4.8","v3.4.7","v3.4.6","server-v3.4.2","ios-v13.4.1","android-v3.4.4","v3.4.5","android-v3.4.3","v3.4.4","transcribe-v3.4.9","transcribe-v3.4.8","transcribe-v3.4.7","transcribe-v3.4.6","transcribe-v3.4.5","transcribe-v3.4.1","v3.4.3","android-v3.4.1","v3.4.2","server-v3.4.1","v3.4.1","v3.3.12","v3.3.11","cli-v3.3.1","v3.3.9","ios-v13.3.7","ios-v13.3.6","android-v3.3.8","v3.3.8","ios-v13.3.5","android-v3.3.7","v3.3.7","ios-v13.1.5","ios-v13.1.4","android-v3.1.5","v3.1.18","v3.1.17","android-v3.1.4","v3.1.16","v3.1.15","v3.1.14","v3.1.13","v3.1.12","v3.1.11","v3.1.10","v3.1.9","v3.1.8","v3.1.7","android-v3.1.3","v3.1.6","v3.1.4","v3.1.3","v3.1.2","clipper-3.1.1","ios-v13.1.3","ios-v13.1.2","android-v3.1.2","ios-v13.1.1","android-v3.1.1","v3.1.1","ios-v13.0.3","android-v3.0.5","v3.0.10","android-v3.0.4","ios-v13.0.2","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","android-v3.0.3","v3.0.4","ios-v13.0.1","android-v3.0.2","v3.0.3","android-v3.0.1","v3.0.2","v3.0.1","ios-v12.14.6","android-v2.14.9","v2.14.17","android-v2.14.8","v2.14.16","ios-v12.14.5","android-v2.14.7","v2.14.15","v2.14.14","ios-v12.14.4","android-v2.14.6","v2.14.13","android-v2.14.5","v2.14.12","android-v2.14.4","v2.14.11","v2.14.10","server-v2.14.2","v2.14.9","v2.14.8","v2.14.7","ios-v12.14.2","android-v2.14.3","v2.14.6","android-v2.14.2","v2.14.5","v2.14.4","v2.14.3","ios-v12.14.1","android-v2.14.1","v2.14.2","v2.14.1","server-v2.14.1","server-v2.13.5","ios-v12.13.7","ios-v12.13.6","android-v2.13.7","v2.13.6","server-v2.13.4","plugin-generator-v2.13.2","cli-v2.13.1","android-v2.13.6","v2.13.5","ios-v12.13.4","v2.13.4","android-v2.13.5","ios-v12.13.3","ios-v12.13.2","android-v2.13.4","android-v2.13.3","ios-v12.13.1","v2.13.3","server-v2.13.2","android-v2.13.2","android-v2.13.1","plugin-generator-v2.13.1","v2.13.2","server-v2.13.1","v2.13.1","android-v2.12.1","v2.12.11","v2.12.10","v2.12.9","v2.12.8","v2.12.7","v2.12.6","server-v2.12.1","v2.12.5","v2.12.4","v2.12.3","v2.12.2","v2.12.1","plugin-generator-v2.12.1","plugin-generator-v2.11.1","v2.11.11","v2.11.10","android-v2.11.26","server-v2.11.2","v2.11.9","v2.11.8","v2.11.7","android-v2.11.25","android-v2.11.24","android-v2.11.23","v2.11.6","ios-v12.11.3","v2.11.5","ios-v12.11.2","ios-v12.11.1","v2.11.4","v2.11.3","server-v2.11.1","android-v2.11.22","android-v2.11.16","android-v2.11.14","v2.11.2","android-v2.11.13","android-v2.11.11","android-v2.11.10","android-v2.11.8","android-v2.11.7","android-v2.11.6","android-v2.11.4","android-v2.11.2","android-v2.11.1","clipper-2.11.2","v2.11.1","server-v2.10.11","server-v2.10.10","android-v2.10.8","cli-v2.10.3","cli-v2.10.2","v2.10.8","v2.10.7","android-v2.10.7","v2.10.6","android-v2.10.6","server-v2.10.9","server-v2.10.8","server-v2.10.7","server-v2.10.6","android-v2.10.5","ios-v12.10.2","v2.10.5","android-v2.10.4","android-v2.10.3","v2.10.4","android-v2.10.2","v2.10.3","android-v2.10.1","ios-v12.10.1","server-v2.10.5","android-v2.9.8","server-v2.9.7","server-v2.9.6","v2.9.12","android-v2.9.7","android-v2.9.6","v2.9.11","v2.9.10","v2.9.9","cli-v2.9.1","android-v2.9.5","android-v2.9.4","server-v2.9.5","server-v2.9.4","server-v2.9.3","server-v2.9.2","android-v2.9.3","server-v2.9.1","v2.9.8","v2.9.7","v2.9.5","android-v2.9.2","v2.9.4","v2.9.3","android-v2.9.1","v2.9.2","v2.9.1","clipper-2.8.1","cli-v2.8.1","v2.8.8","v2.8.7","v2.8.6","v2.8.5","plugin-generator-v2.8.1","v2.8.4","v2.8.3","v2.8.2","v2.8.1","ios-v12.7.1","v2.7.12","android-v2.7.2","v2.7.11","android-v2.7.1","v2.7.10","v2.7.9","server-v2.7.4","v2.7.8","v2.7.7","v2.7.6","v2.7.5","v2.7.4","v2.7.3","v2.7.2","v2.7.1","server-v2.7.3","server-v2.7.2","server-v2.7.1","plugin-generator-v2.7.3","plugin-generator-v2.7.2","plugin-generator-v2.7.1","plugin-repo-cli-v2.6.9","android-v2.6.8","android-v2.6.6","v2.6.6","android-v2.6.5","v2.6.5","v2.6.4","v2.6.3","server-v2.6.14","android-v2.6.4","server-v2.6.13","server-v2.6.12","android-v2.6.3","v2.6.2","server-v2.6.11","server-v2.6.10","server-v2.6.9","server-v2.6.8","server-v2.6.7","server-v2.6.6","server-v2.6.5","server-v2.6.4","server-v2.6.3","server-v2.6.2","v2.6.1","server-v2.6.1","cli-v2.6.1","android-v2.6.1","v2.5.10","v2.5.9","android-v2.5.5","android-v2.5.4","v2.5.8","v2.5.7","android-v2.5.3","v2.5.6","android-v2.5.2","v2.5.5","server-v2.5.9","server-v2.5.8","server-v2.5.7","server-v2.5.6","server-v2.5.5","server-v2.5.4","server-v2.5.3","v2.5.4","v2.5.3","server-v2.5.2","v2.5.1","server-v2.5.1","server-v2.4.11-beta","server-v2.4.10-beta","android-v2.4.2","server-v2.4.9-beta","v2.4.8","v2.4.7","server-v2.4.8-beta","server-v2.4.7-beta","server-v2.4.6-beta","server-v2.4.5-beta","server-v2.4.4-beta","v2.4.6","v2.4.5","server-v2.4.3-beta","server-v2.4.2","v2.4.3","v2.4.2","server-v2.3.1-beta","android-v2.2.3","android-v2.2.2","v2.2.6","v2.2.5","v2.2.4","v2.2.3","server-v2.2.11-beta","server-v2.2.10","server-v2.2.9-beta","server-v2.2.7-beta","server-v2.2.6-beta","server-v2.2.5-beta","server-v2.2.4-beta","server-v2.2.3-beta","server-v2.2.2-beta","server-v2.2.1-beta","server-v2.1.6-beta","server-v2.1.5-beta","server-v2.1.4-beta","v2.1.5","v2.1.4","android-v2.1.2","android-v2.1.1","server-v2.1.3-beta","v2.1.1","server-v2.1.2-beta","server-v2.1.1","server-v2.0.14","cli-v2.0.1","plugin-generator-v2.0.1","v2.0.11","server-v2.0.13","android-v2.0.4","android-v2.0.3","ios-v12.0.2","ios-v20.0.1","android-v2.0.2","v2.0.10","server-v2.0.12","server-v2.0.11","server-v2.0.10","v2.0.9","server-v2.0.9-beta","server-v2.0.8-beta","v2.0.8","v2.0.7","v2.0.6","v2.0.5","server-v2.0.6","server-v2.0.5","v2.0.4","v2.0.3","v2.0.1","android-v1.8.4","v1.8.3","android-v1.8.3","v1.8.2","android-v1.8.2","android-v1.8.1","v1.8.1","v1.7.6","v1.7.5","server-v1.7.2","v1.7.4","plugin-generator-v1.7.3","plugin-generator-v1.7.2","plugin-generator-v1.7.1","cli-v1.6.3","cli-v1.6.2","ios-v10.6.2","cli-v1.6.1","android-v1.6.6","android-v1.6.5","v1.6.6","v1.6.5","plugin-generator-v1.6.11","v1.6.4","plugin-generator-v1.6.10","plugin-generator-v1.6.9","plugin-generator-v1.6.8","plugin-generator-v1.6.7","plugin-generator-v1.6.6","plugin-generator-v1.6.5","plugin-generator-v1.6.4","v1.6.2","plugin-generator-v1.6.3","server-v1.6.4","plugin-generator-v1.6.2","android-v1.6.4","android-v1.6.3","android-v1.6.2","v1.6.1","ios-v10.5.1","v1.5.11","android-v1.5.1","cli-v1.5.1","v1.5.10","v1.5.9","v1.5.8","v1.5.7","v1.5.6","v1.5.5","v1.5.3","v1.5.2","v1.5.1","ios-v10.4.1","android-v1.4.11","v1.4.11","plugin-generator-v1.4.5","clipper-1.4.3","v1.4.8","v1.4.7","ios-v10.3.1","v1.4.6","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.1","android-v1.3.13","android-v1.3.11","v1.3.15","v1.3.14","android-v1.3.10","clipper-1.3.1","v1.3.10","cli-v1.3.3","cli-v1.3.2","cli-v1.3.1","android-v1.3.9","v1.3.9","v1.3.8","v1.3.7","v1.3.5","v1.3.4","android-v1.3.7","v1.3.3","v1.3.2","v1.3.1","cli-v1.2.1","v1.1.3","v1.1.2","v1.1.1","v1.1.244","v1.0.242","v1.0.243","android-v1.0.340","android-v1.0.339-3","v1.0.239","v1.0.238","v1.0.235","android-v1.0.337","v1.0.234","v1.0.214","v1.0.213","v1.0.212","v1.0.211","v1.0.210","v1.0.209","v1.0.208","cli-v1.0.164","v1.0.207","v1.0.206","v1.0.200","cli-v1.0.163","ios-v10.0.47","android-v1.0.327","v1.0.199","android-v1.0.326","v1.0.198","cli-v1.0.162","v1.0.197","android-v1.0.325","v1.0.196","android-v1.0.324","android-v1.0.323","v1.0.195","v1.0.194","android-v1.0.322","android-v1.0.321","clipper-1.0.25","clipper-1.0.23","ios-v10.0.45","android-v1.0.320","v1.0.193","cli-v1.0.161","cli-v1.0.160","cli-v1.0.159","cli-v1.0.158","cli-v1.0.157","cli-v1.0.156","android-v1.0.319-rc1","v1.0.192","v1.0.191","v1.0.190","v1.0.189","v1.0.188","clipper-1.0.22","clipper-1.0.21","v1.0.187","v1.0.186","v1.0.185","clipper-1.0.20","ios-v10.0.44","android-v1.0.318","android-v1.0.317","cli-v1.0.155","v1.0.184","v1.0.183","v1.0.182","cli-v1.0.154","ios-v10.0.43","android-v1.0.316","v1.0.179","v1.0.178","android-v1.0.315","v1.0.177","android-v1.0.314","android-v1.0.313","v1.0.176","ios-v10.0.41","android-v1.0.312","v1.0.175","android-v1.0.311","ios-v10.0.40","v1.0.174","clipper-1.0.19","cli-v1.0.150","ios-v10.0.39","v1.0.172","android-v1.0.310","v1.0.171","android-v1.0.309","android-v1.0.308","v1.0.170","cli-v1.0.149","cli-v1.0.148","android-v1.0.307","v1.0.169","cli-v1.0.147","android-v1.0.306","v1.0.168","ios-v10.0.37","android-v1.0.305","v1.0.167","android-v1.0.304","v1.0.166","cli-v1.0.146","cli-v1.0.145","android-v1.0.303","android-v1.0.299","v1.0.165","v1.0.164","v1.0.163","android-v1.0.294","v1.0.162","cli-v1.0.141","android-v1.0.293","android-v1.0.292","android-v1.0.291","android-v1.0.290","android-v1.0.289","android-v1.0.284","android-v1.0.283","android-v1.0.281","v1.0.161","android-v1.0.279","android-v1.0.277","clipper-1.0.17","android-v1.0.276","ios-v10.0.35","android-v1.0.271","android-v1.0.269","v1.0.160","android-v1.0.261","v1.0.159","android-v1.0.260","cli-v1.0.139","v1.0.158","android-v1.0.255","android-v1.0.254","v1.0.157","v1.0.156","android-v1.0.253","v1.0.155","v1.0.154","cli-v1.0.137","cli-v1.0.136","v1.0.153","cli-v1.0.135","cli-v1.0.133","cli-v1.0.129","cli-v1.0.128","cli-v1.0.127","ios-v10.0.34","android-v1.0.252","v1.0.152","cli-v1.0.126","clipper-1.0.14","ios-v10.0.33","android-v1.0.251","v1.0.151","android-v1.0.248","v1.0.150","v1.0.149","ios-v10.0.31","android-v1.0.243","v1.0.143","v1.0.142","clipper-1.0.13","clipper-1.0.12","clipper-1.0.10","android-v1.0.242","cli-v1.0.124","android-v1.0.241","v1.0.140","android-v1.0.240","v1.0.139","v1.0.138","v1.0.137","v1.0.136","v1.0.135","v1.0.134","v1.0.133","ios-v10.0.30","v1.0.132","v1.0.131","android-v1.0.239","v1.0.130","v1.0.129","android-v1.0.238","v1.0.128","android-v1.0.237","v1.0.127","cli-v1.0.123","cli-v1.0.122","v1.0.126","ios-v10.0.29","v1.0.125","android-v1.0.236","android-v1.0.234","v1.0.123","android-v1.0.233","v1.0.120","cli-v1.0.120","android-v1.0.232","android-v1.0.225","android-v1.0.224","android-v1.0.201","android-v1.0.200","android-v1.0.181","clipper-1.0.8","android-v1.0.179","ios-v10.0.27","android-v1.0.178","v1.0.119","android-v1.0.177","v1.0.118","v1.0.117","cli-v1.0.118","android-v1.0.176","v1.0.116","v1.0.115","cli-v1.0.117","android-v1.0.175","v1.0.114","android-v1.0.151","android-v1.0.148","v1.0.113","android-v1.0.142","v1.0.112","android-v1.0.141","android-v1.0.140","android-v1.0.138","v1.0.111","android-v1.0.135","v1.0.110","cli-v1.0.115","clipper-1.0.7","android-v1.0.133","v1.0.109","v1.0.108","android-v1.0.132","v1.0.107","v1.0.106","cli-v1.0.114","android-v1.0.131","v1.0.105","cli-v1.0.113","cli-v1.0.110","cli-v1.0.109","android-v1.0.129","v1.0.104","v1.0.103","untagged-6ad6c38d382d9cf912e5","android-v1.0.128","v1.0.102","v1.0.101","cli-v1.0.108","android-v1.0.127","v1.0.100","v1.0.99","v1.0.98","v1.0.97","v1.0.96","v1.0.95","v1.0.94","ios-v10.0.22","v1.0.93","v1.0.92","android-v1.0.125","cli-v1.0.107","v1.0.91","android-v1.0.124","v1.0.90","android-v1.0.123","ios-v10.0.21","android-v1.0.122","v1.0.89","v1.0.88","v1.0.87","android-v1.0.120","v1.0.86","v1.0.85","v1.0.84","android-v1.0.119","android-v1.0.118","cli-v1.0.106","v1.0.83","v1.0.82","android-v1.0.116","v1.0.81","android-v1.0.115","android-v1.0.103","cli-v1.0.100","v1.0.70","v1.0.69","v1.0.68","android-v1.0.102","ios-v1.0.13","cli-v1.0.99","v1.0.67","android-v1.0.101","android-v1.0.100","v1.0.66","cli-v1.0.98","cli-v1.0.97","cli-v1.0.96","v1.0.64","android-v1.0.98","android-v1.0.97","v1.0.63","cli-v1.0.95","android-v1.0.95","v1.0.62","android-v1.0.94","android-v0.10.92","v0.10.61","android-v0.10.91","android-v0.10.90","android-v0.10.89","android-v0.10.88","cli-v0.10.93","android-v0.10.86","v0.10.60","v0.10.59","android-v0.10.85","v0.10.58","v0.10.57","android-v0.10.83","v0.10.56","v0.10.55","cli-v0.10.87","android-v0.10.71","v0.10.43","v0.10.42","cli-v0.10.86","android-v0.10.69","v0.10.41","ios-v0.10.6","v0.10.38","android-v0.10.65","v0.10.37","v0.10.36","android-v0.10.62","v0.10.35","v0.10.34","v0.10.33","v0.10.32","v0.10.31","android-v0.10.61","v0.10.30","v0.10.29","v0.10.28","v0.10.27","v0.10.26"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57798.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}