The vulnerability is an uncontrolled resource allocation flaw in Joplin’s title input handling (CWE‑770). An attacker can submit an excessively long string as a note title either via the graphical interface or through the local web service API, causing the application to attempt to allocate more memory than it can manage, which results in an out‑of‑memory error and application termination. This denial of service can degrade the availability of Joplin for the affected user or process.

Affected by v3.6.14 and earlier versions of the laurent22 Joplin note‑taking application. Versions 3.7.1 and later contain a fix that enforces proper length validation of note titles. The flaw exists in the open‑source codebase and is documented in the GitHub repository under commit 5b8795da.

The CVSS score of 5.5 indicates moderate severity, and there is no EPSS score reported, suggesting limited publicly documented exploitation. However, the vulnerability is exploitable locally by any user who can enter a note, and an attacker who gains a malicious authentication token for Joplin’s local API can trigger the DoS remotely on the host machine. The issue is not listed in CISA’s KEV catalog, but its impact—application crash—can be disruptive in environments that rely on Joplin for critical note management.