CVE-2026-23829
SMTP Header Injection in Mailpit SMTP Server Allows Header Manipulation
Publication date: 2026-01-19
Last updated on: 2026-02-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| axllent | mailpit | to 1.28.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-150 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component. |
| CWE-93 | The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-23829 is a vulnerability in Mailpit's SMTP server where the regular expressions used to validate email addresses in the RCPT TO and MAIL FROM commands fail to exclude carriage return (\r) and line feed (\n) characters. This allows an attacker to inject arbitrary SMTP headers by including these control characters in email addresses, leading to SMTP Header Injection. The flaw arises because the regex intended to block control characters does not properly exclude \r and \n, enabling attackers to corrupt email headers and potentially manipulate email processing. [3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject arbitrary SMTP headers into emails processed by Mailpit. This can corrupt raw email files (.eml), causing downstream mail systems like Outlook or Exchange to misinterpret or mishandle the emails. It can lead to false security assumptions, as malformed emails may appear valid in Mailpit but fail in production environments. Additionally, the vulnerability can cause denial of service through null byte injection and other control character issues, impacting data integrity and reliability of email testing. [3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by monitoring SMTP traffic for suspicious RCPT TO or MAIL FROM commands containing carriage return characters (\r) or other control characters injected into email addresses. Since the vulnerability involves header injection via malformed SMTP envelope addresses, inspecting SMTP sessions for unusual or malformed addresses is key. Commands to capture and analyze SMTP traffic include using packet capture tools like tcpdump or Wireshark to filter SMTP traffic, for example: 1. tcpdump -i <interface> -A port 25 | grep -P '\r' 2. tshark -i <interface> -Y 'smtp.req.command == "RCPT" or smtp.req.command == "MAIL"' -T fields -e smtp.req.parameter 3. Using grep or similar tools on SMTP logs to find addresses containing carriage return or newline characters. Additionally, testing the SMTP server by sending RCPT TO or MAIL FROM commands with injected carriage return characters and observing if the server accepts them can help confirm vulnerability presence. [3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Mailpit to version 1.28.3 or later, which includes a fix that enforces strict validation of SMTP TO and FROM email addresses according to RFC 5322 standards, preventing header injection attacks. This update introduces a new validation function that rejects malformed addresses containing control characters such as carriage returns. If upgrading immediately is not possible, consider implementing network-level filtering to block SMTP commands with suspicious or malformed envelope addresses containing control characters. However, the recommended and effective mitigation is to apply the official patch in version 1.28.3. [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows SMTP header injection by permitting carriage return characters in email addresses, which leads to malformed email headers and corrupted raw email files. This can cause downstream mail systems to misinterpret emails and potentially expose or mishandle email data. Such data integrity issues and malformed emails could lead to non-compliance with standards and regulations like GDPR and HIPAA that require secure and accurate handling of personal and sensitive information. The fix enforces strict compliance with RFC 5321 and RFC 5322 email formatting standards, which helps maintain proper email data integrity and security, thereby supporting compliance with these regulations. [2, 3]