CVE-2026-45713
Received Received - Intake

Uncontrolled Memory Consumption in Mailpit SMTP Server

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value (0 ⇒ "no limit"). The same applies to the HTTP /api/v1/send endpoint, whose request body is decoded with json.NewDecoder(r.Body) and no http.MaxBytesReader. Because Mailpit's default listeners bind [::]:1025 (SMTP) and [::]:8025 (HTTP), with no authentication required on either, a single network-reachable attacker can push an arbitrarily large message into Mailpit and watch RAM consumption spike with a ~7-10× amplification factor (raw frame → enmime envelope tree → search-text index → zstd-encoded write to SQLite). Repeating the attack — or running it concurrently from multiple connections — drives the process to OOM-kill. Version 1.30.0 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-45713
EUVD
EUVD-2026-45972

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
axllent mailpit to 1.30.0 (exc)
axllent mailpit 1.30.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mailpit before version 1.30.0 has a flaw where the SMTP server's maximum message size limit is never set, defaulting to no limit. The HTTP API endpoint also lacks request size restrictions. Attackers can exploit this by sending extremely large messages, causing rapid memory and disk consumption spikes that may crash the service.

Detection Guidance

Monitor for unusually high RAM or disk usage on systems running Mailpit versions before 1.30.0. Check for large incoming SMTP or HTTP requests using network traffic analysis tools like tcpdump or Wireshark. Inspect Mailpit logs for errors related to memory exhaustion or OOM kills.

Impact Analysis

An unauthenticated remote attacker could send massive messages to Mailpit, consuming all available RAM and potentially disk space. This leads to system slowdowns, crashes, or complete denial of service. The attack requires no privileges or user interaction.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt email services, potentially leading to unauthorized data processing or loss of availability for sensitive communications. Unbounded memory and disk consumption may also risk data integrity and confidentiality if exploited to store excessive data.

Mitigation Strategies

Upgrade Mailpit to version 1.30.0 or later immediately. If upgrading is not possible, restrict network access to Mailpit's SMTP (port 1025) and HTTP (port 8025) listeners using firewalls. Disable unauthenticated access if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45713. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart