CVE-2025-53603 Null dereference in SOPE
An attacker can crash the SOGo server by sending a request with duplicate parameters in the query string and POST body.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53603?
CVE-2025-53603 is a high-severity vulnerability in Alinto SOPE, published on 5 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.
Weakness: CWE-476
Which versions are affected by CVE-2025-53603?
How do I fix CVE-2025-53603?
Apply the vendor's patch.
Is CVE-2025-53603 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53603 exists.
Sources
Also known as DEBIAN-CVE-2025-53603, DLA-4260-1, DSA-5970-1, GHSA-78j7-w964-99fc, MGASA-2025-0255, UBUNTU-CVE-2025-53603.