A malformed MIME structure in Stalwart Mail Server emails triggers the mail-parser crate to create circular references. The server follows these references indefinitely, consuming excessive CPU and memory until the process crashes. The vulnerability is a classic resource exhaustion flaw, categorized as CWE-770, that can halt mail service availability without compromising confidentiality or integrity.

Stalwart Mail Server versions 0.13.0 through 0.15.4 are affected. All deployments that expose IMAP or JMAP interfaces to potentially hostile external users could be impacted. Version 0.15.5 includes the required patch.

The CVSS score of 6.5 indicates moderate severity, but the EPSS score of less than 1% suggests a low probability of exploitation under current conditions. The attack vector is inferred to be remote, requiring an attacker to send a specifically crafted email via IMAP or JMAP. Once the malicious message is accessed, the server experiences rapid resource drain, leading to an out-of-memory condition and crash.