Is CVE-2025-57798 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-57798 being exploited in the wild.

How severe is CVE-2025-57798?

Medium severity, with a CVSS score of 5.5, published 19 May 2026.

Is there a fix for CVE-2025-57798?

A patch was published on 2026-05-19: Fix committed and version 3.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-57798 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2025-57798?

Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-57798: Joplin denial of service via uncontrolled resource allocation in note titles

CVE-2025-57798 · Severity: medium · CVSS 5.5 · Published 2026-05-19

Joplin is an open-source note-taking and to-do application. A vulnerability in how the application handles note titles allows an attacker to crash the software by providing an excessively long title string. This results in a denial-of-service condition where the application becomes unresponsive or terminates, potentially leading to the loss of unsaved work and preventing the user from accessing their notes until the issue is resolved.

Technologies: Joplin. Vendors: Joplin.

Quick answers

Is CVE-2025-57798 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-57798 being exploited in the wild.
How severe is CVE-2025-57798?: Medium severity, with a CVSS score of 5.5, published 19 May 2026.
Which products and versions are affected?: Joplin <= 3.6.14.
Is there a fix for CVE-2025-57798?: A patch was published on 2026-05-19: Fix committed and version 3.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-57798 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-57798?: Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Denial of Service (DoS) vulnerability exists in Joplin versions 3.6.14 and prior due to uncontrolled resource allocation (CWE-770) in the title input functionality. The application fails to validate the maximum length of strings provided for note or notebook titles. An attacker can exploit this by either manually pasting a massive string into the UI or programmatically sending a crafted HTTP POST request to the local web service API (typically on port 41184) if they have obtained an authentication token. This causes the application to attempt an unbounded memory allocation, leading to an Out Of Memory (OOM) error and process termination. In some cases, the long title is saved to the database, causing the application to crash immediately upon subsequent restarts. The issue is patched in version 3.7.1.

Affected products

Joplin Joplin <= 3.6.14

Timeline

2026-05-15: advisory: GitHub Security Advisory published
2026-05-19: disclosed: NVD publication date
2026-05-19: patched: Fix committed and version 3.7.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.