CVE-2026-67447

Received Received - Intake

Memory Exhaustion via SMTP DATA Line in Mailpit

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-67447

Affected Vendors & Products

Vendor	Product	Version / Range
mailpit	mailpit	to 1.30.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

Mailpit versions 1.30.0 to 1.30.5 have a flaw in the SMTP data handling function readData(). It reads an entire line before checking if the line exceeds the configured maximum message size. This allows unauthenticated attackers to send oversized lines, causing excessive memory allocation before Mailpit rejects the message.

Detection Guidance

Monitor Mailpit logs for unusually large SMTP DATA lines or memory pressure warnings. Check for rejected oversized lines with error code 552 5.3.4 in logs. Use network monitoring tools to detect SMTP clients sending excessively large single lines.

Impact Analysis

An attacker could exploit this to consume excessive server memory, potentially leading to degraded performance, crashes, or denial-of-service conditions. The vulnerability does not allow data theft or privilege escalation but may disrupt email services.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it relates to memory allocation in an email testing tool rather than data protection or privacy controls. However, if exploited, it could lead to service disruption or denial-of-service, potentially affecting availability requirements under these standards.

Mitigation Strategies

Upgrade Mailpit to version 1.30.5 or later immediately. Review and adjust MaxMessageSize settings to prevent oversized lines. Monitor system memory usage and SMTP traffic for anomalies.

Hi! I’m here to help you understand CVE-2026-67447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70