CVE-2026-45712
Received Received - Intake

Race Condition in Mailpit Leads to Fatal Concurrent Map Access

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go's runtime raises fatal error: concurrent map read and map write — a runtime.throw that is not recoverable by http.Server's handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it. Version 1.30.0 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-45712
EUVD
EUVD-2026-45971

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
axllent mailpit to 1.29.8 (exc)
axllent mailpit to 1.30.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45712 is a race condition vulnerability in Mailpit versions before 1.30.0. It occurs in the screenshot/print proxy endpoint where a shared assets map is accessed without proper synchronization. A cleanup goroutine or CSS-rewriting code writes to the map under a lock while the proxy handler reads it without holding the lock. This concurrent access causes a fatal runtime error, crashing the entire Mailpit process and taking down SMTP, POP3, and HTTP listeners.

Detection Guidance

Detect Mailpit versions prior to 1.30.0 using commands like 'mailpit --version' or checking package managers (e.g., 'apt list --installed | grep mailpit'). Monitor for crashes in Mailpit processes or SMTP/POP3/HTTP listener failures.

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to crash the Mailpit service by sending a message with a stylesheet link and making concurrent requests to the proxy endpoint. The crash results in a denial-of-service (DoS) condition, disrupting email testing and API functionality. Since Mailpit handles SMTP, POP3, and HTTP traffic, the entire service becomes unavailable until restarted.

Compliance Impact

This vulnerability causes a denial-of-service by crashing Mailpit, disrupting email services. For GDPR, this could impact data processing integrity and availability. For HIPAA, it may lead to service unavailability affecting protected health information access. Compliance depends on mitigating the DoS risk.

Mitigation Strategies

Upgrade Mailpit to version 1.30.0 or later immediately. If upgrading is not possible, restrict access to the proxy endpoint (/proxy) via network controls or disable the proxy feature until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45712. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart