CVE-2026-67445

Received Received - Intake

Memory Exhaustion in Mailpit SMTP Command Parsing

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-67445

Affected Vendors & Products

Vendor	Product	Version / Range
mailpit	mailpit	to 1.30.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Mailpit before version 1.30.4 has a vulnerability where SMTP commands are read without enforcing the RFC 5321 512-octet command-line limit. An unauthenticated remote client can send oversized commands that consume excessive memory before rejection, potentially causing service slowdowns or crashes.

Detection Guidance

Detecting this vulnerability requires checking if your Mailpit instance is running a version prior to 1.30.4. Use commands like 'mailpit --version' or check package managers (e.g., 'apt list --installed | grep mailpit' or 'docker inspect <container> | grep Mailpit'). Monitor for unusual memory usage or service degradation during SMTP interactions.

Impact Analysis

This vulnerability can lead to reduced service availability due to memory exhaustion from concurrent oversized inputs. It may cause Mailpit to slow down or crash, disrupting email testing and API functionality for developers.

Mitigation Strategies

Upgrade Mailpit to version 1.30.4 or later immediately. If upgrading is not possible, restrict network access to the SMTP service using firewalls or disable unauthenticated SMTP access until patched. Monitor system resources for abnormal memory consumption.

Hi! I’m here to help you understand CVE-2026-67445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70