Executive brief
Joplin is an open-source note-taking and to-do application. A vulnerability in how the application handles note titles allows an attacker to crash the software by providing an excessively long title string. This results in a denial-of-service condition where the application becomes unresponsive or terminates, potentially leading to the loss of unsaved work and preventing the user from accessing their notes until the issue is resolved.
Technical details
A Denial of Service (DoS) vulnerability exists in Joplin versions 3.6.14 and prior due to uncontrolled resource allocation (CWE-770) in the title input functionality. The application fails to validate the maximum length of strings provided for note or notebook titles. An attacker can exploit this by either manually pasting a massive string into the UI or programmatically sending a crafted HTTP POST request to the local web service API (typically on port 41184) if they have obtained an authentication token. This causes the application to attempt an unbounded memory allocation, leading to an Out Of Memory (OOM) error and process termination. In some cases, the long title is saved to the database, causing the application to crash immediately upon subsequent restarts. The issue is patched in version 3.7.1.
Affected products
- Joplin Joplin <= 3.6.14
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-05-19: disclosed: NVD publication date
- 2026-05-19: patched: Fix committed and version 3.7.1 released