GHSA-m6m5-pp4g-fcc8
S3 storage write is not aborted on errors leading to unbounded memory usage
Impact
Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql.
storage.imapsql local_mailboxes {
...
msg_store s3 {
...
}
}
Patches
The relevant commit is pushed to master and will be included in the 0.5.1 release.
No special handling of the issue has been done due to the small amount of affected users.
Workarounds
None.
References
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
S3 storage write is not aborted on errors leading to unbounded memory usage
Impact
Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql.
storage.imapsql local_mailboxes {
...
msg_store s3 {
...
}
}
Patches
The relevant commit is pushed to master and will be included in the 0.5.1 release.
No special handling of the issue has been done due to the small amount of affected users.
Workarounds
None.
References
- Record
GHSA-m6m5-pp4g-fcc8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-02
OSV
S3 storage write is not aborted on errors leading to unbounded memory usage
Impact
Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql.
storage.imapsql local_mailboxes {
...
msg_store s3 {
...
}
}
Patches
The relevant commit is pushed to master and will be included in the 0.5.1 release.
No special handling of the issue has been done due to the small amount of affected users.
Workarounds
None.
References
- Record
GHSA-m6m5-pp4g-fcc8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-02
OSVGO-2022-0374No score
S3 storage write is not aborted on errors leading to unbounded memory usage in github.com/foxcpp/maddy
S3 storage write is not aborted on errors leading to unbounded memory usage in github.com/foxcpp/maddy
- Record
GO-2022-0374- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/foxcpp/maddyGo | before 0.5.1 | 0.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-m6m5-pp4g-fcc8 is a high vulnerability (CVSS 7.5) in github.com/foxcpp/maddy, published October 6, 2021. No source lists public exploit code. Fixed in github.com/foxcpp/maddy 0.5.1.