CVE-2026-67445 - Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Back Back to CVE browser

HIGH

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Published Aug 20, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.51%

Description

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.

Affected products

Vendor Axllent Product Mailpit Default
n/a
- Version
  < 1.30.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Axllent

Mailpit

n/a

Version	Status	Constraints
< 1.30.4	affected	-

Ecosystem	Package	Introduced	Fixed
Go	github.com/axllent/mailpit	0	1.30.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (5)

https://github.com/advisories/GHSA-w878-pj84-3j5v
Advisory
https://github.com/axllent/mailpit/commit/993bed95b3c74d95231af93bd0e0d4c3d5b4db4d
x_refsource_MISC
https://github.com/axllent/mailpit/releases/tag/v1.30.4
x_refsource_MISC
https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v
x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-67445

Link	Providers	Tags
https://github.com/advisories/GHSA-w878-pj84-3j5v		Advisory
https://github.com/axllent/mailpit/commit/993bed95b3c74d95231af93bd0e0d4c3d5b4db4d		x_refsource_MISC
https://github.com/axllent/mailpit/releases/tag/v1.30.4		x_refsource_MISC
https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-67445