CVE-2026-67446

Received Received - Intake

Memory Exhaustion in Mailpit via Malicious Image Attachments

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-67446

Affected Vendors & Products

Vendor	Product	Version / Range
mailpit	mailpit	to 1.30.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

Mailpit is an email testing tool that had a vulnerability in versions before 1.30.4. The issue occurs in the thumbnail generation endpoint where Mailpit decodes attacker-supplied image attachments fully before checking their dimensions or memory usage. This allows a crafted image with large declared dimensions to consume excessive memory and CPU resources when processed.

Detection Guidance

Check Mailpit version with 'mailpit --version' or inspect running processes. Monitor for high memory/CPU usage when accessing message attachments. Review logs for repeated requests to /api/v1/message/{id}/part/{partID}/thumb endpoints.

Impact Analysis

An unauthenticated attacker could exploit this by storing a specially crafted image attachment and triggering the vulnerable endpoint through the web API. This could lead to degraded system performance or denial of service by consuming excessive server resources.

Mitigation Strategies

Upgrade Mailpit to version 1.30.4 or later immediately. If upgrading is not possible, restrict network access to the Mailpit web interface and API endpoints until patched.

Hi! I’m here to help you understand CVE-2026-67446. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70