CVE-2026-48824
Received Received - Intake

Memory Exhaustion in Mailpit via Unbounded JSON Arrays

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes") wrapped only `POST /api/v1/send` with `http.MaxBytesReader`. The four other Mailpit JSON-body API endpoints `PUT /api/v1/messages` (SetReadStatus), `DELETE /api/v1/messages` (DeleteMessages), `PUT /api/v1/tags` (SetMessageTags), and `POST /api/v1/message/{id}/release` (ReleaseMessage) still call `json.NewDecoder(r.Body)` directly with no body-size cap and remain reachable unauthenticated in the default `docker run axllent/mailpit:latest` deploy. An unauthenticated remote attacker can post a multi-million-element `IDs` slice and drive RSS from ~25 MiB baseline to ~450 MiB per 16 MB request body. Repeating across multiple connections accumulates the same per-request amplification per process. Version 1.30.1 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-48824
EUVD
EUVD-2026-45973

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
axllent mailpit to 1.30.1 (exc)
axllent mailpit 1.30.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48824 is a memory-exhaustion denial-of-service (DoS) vulnerability in Mailpit, an email testing tool. It affects four API endpoints that process JSON request bodies without size limits. An unauthenticated attacker can send a large JSON payload, causing Mailpit's memory usage to spike from 25 MiB to 450 MiB per request. The issue stems from Go's handling of large JSON arrays, which creates excessive memory overhead.

Detection Guidance

Monitor Mailpit process memory usage and network traffic to the vulnerable endpoints. Check for large JSON payloads sent to PUT /api/v1/messages, DELETE /api/v1/messages, PUT /api/v1/tags, or POST /api/v1/message/{id}/release. Use tools like curl to test endpoint responses with oversized payloads.

Impact Analysis

This vulnerability can lead to service disruption by consuming excessive memory on the Mailpit server. An attacker could repeatedly send large requests, causing the process or host to run out of memory and crash. Systems running Mailpit versions 1.30.0 or earlier are vulnerable, especially default deployments without authentication.

Compliance Impact

This vulnerability primarily impacts system availability due to memory exhaustion from DoS attacks. While it does not directly expose or leak data, prolonged downtime could disrupt services handling sensitive information. GDPR requires ensuring availability of processing systems, so prolonged outages may pose compliance risks. HIPAA similarly mandates safeguards against disruptions to electronic protected health information systems.

Mitigation Strategies

Upgrade Mailpit to version 1.30.1 or later. Apply the same 50MB body-size limit to all vulnerable endpoints using http.MaxBytesReader or enforce global middleware restrictions. Restrict network access to Mailpit if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48824. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart