CVE-2025-53603: Alinto Sope

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.

Affected products

• Alinto Sope

Published 2025-07-05. Last modified 2026-06-17.