# CVE-2025-57798: Joplin denial of service via uncontrolled resource allocation in note titles

Source: https://junglewise.ai/threats/cve-2025-57798-joplin-denial-of-service-via-uncontrolled-resource-allocation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-57798 · Severity: medium · CVSS 5.5 · Published 2026-05-19

Joplin is an open-source note-taking and to-do application. A vulnerability in how the application handles note titles allows an attacker to crash the software by providing an excessively long title string. This results in a denial-of-service condition where the application becomes unresponsive or terminates, potentially leading to the loss of unsaved work and preventing the user from accessing their notes until the issue is resolved.

Technologies: [Joplin](https://junglewise.ai/threats/technologies/joplin). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin).

## Quick answers

**Is CVE-2025-57798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-57798 being exploited in the wild.

**How severe is CVE-2025-57798?** Medium severity, with a CVSS score of 5.5, published 19 May 2026.

**Which products and versions are affected?** Joplin <= 3.6.14.

**Is there a fix for CVE-2025-57798?** A patch was published on 2026-05-19: Fix committed and version 3.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-57798 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-57798?** Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Denial of Service (DoS) vulnerability exists in Joplin versions 3.6.14 and prior due to uncontrolled resource allocation (CWE-770) in the title input functionality. The application fails to validate the maximum length of strings provided for note or notebook titles. An attacker can exploit this by either manually pasting a massive string into the UI or programmatically sending a crafted HTTP POST request to the local web service API (typically on port 41184) if they have obtained an authentication token. This causes the application to attempt an unbounded memory allocation, leading to an Out Of Memory (OOM) error and process termination. In some cases, the long title is saved to the database, causing the application to crash immediately upon subsequent restarts. The issue is patched in version 3.7.1.

## Affected products

- Joplin Joplin <= 3.6.14

## Timeline

- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-05-19: disclosed: NVD publication date
- 2026-05-19: patched: Fix committed and version 3.7.1 released

## References

- [https://github.com/laurent22/joplin/commit/5b8795da446a5a40c9e212c98b35e368ffce628e](https://github.com/laurent22/joplin/commit/5b8795da446a5a40c9e212c98b35e368ffce628e)
- [https://github.com/laurent22/joplin/security/advisories/GHSA-6jm8-gr87-q69x](https://github.com/laurent22/joplin/security/advisories/GHSA-6jm8-gr87-q69x)

## Related threats

- [Joplin CSS injection in whiteboard text and file nodes](https://junglewise.ai/threats/cve-2026-105784-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin XSS vulnerability in HTML note links](https://junglewise.ai/threats/cve-2026-46650-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin cross-site scripting in Fountain code blocks](https://junglewise.ai/threats/cve-2026-55105-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin path traversal in resource synchronization](https://junglewise.ai/threats/cve-2026-49453-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin path traversal in OneNote importer](https://junglewise.ai/threats/cve-2026-22810-joplin-path-traversal-in-onenote-importer)