Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2025-53603: Alinto SOGo may crash with duplicate query and POST parameters
CVE-2025-53603 · published 1 year ago
Summary
Versions of Alinto SOGo from 2.0.2 up to 5.12.2 can stop working if a web request contains the same parameter both in the URL query string and in the body of the request. This causes the software to crash, interrupting email and calendar access. Update to a newer SOGo version or apply the vendor's patch to prevent the crash.
What to do
- Update debian sope to version 5.8.0-1+deb12u1.
- Update debian sope to version 5.12.1-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | sope |
< 5.8.0-1+deb12u1 Fix: upgrade to 5.8.0-1+deb12u1
|
| Debian:13 | debian | sope |
< 5.12.1-2 Fix: upgrade to 5.12.1-2
|
| Debian:14 | debian | sope |
< 5.12.1-2 Fix: upgrade to 5.12.1-2
|
| Ubuntu:Pro:16.04:LTS | canonical | sogo | All versions |
Original advisory text
In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate o...
In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.
References
- https://security-tracker.debian.org/tracker/CVE-2025-53603 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-53603 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-53603 Third Party Advisory
- https://github.com/Alinto/sope/blob/3146fbdb6ff3314e37e5c3682deeeef7d0f32064/sop... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53603... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-53603 Vendor Advisory
- https://www.openwall.com/lists/oss-security/2025/07/02/3 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2025/07/05/1 URL
- https://lists.debian.org/debian-lts-announce/2025/08/msg00001.html URL
- https://github.com/Alinto/sope/commit/280104e45c20519ac4849ebf8bca114d91383543 Patch
- https://github.com/Alinto/sope/pull/69 Third Party Advisory
- https://github.com/Alinto/sope/compare/SOGo-2.0.1...SOGo-2.0.2 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published5 Jul 2025
Updated4 Nov 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2025-53603 · OSV
CVE-2025-53603 · NVD
UBUNTU-CVE-2025-53603 · OSV
CVE-2025-53603 · OSV
Track software like this
Free during beta