PT-2026-55207 · Mailpit · Mailpit
CVE-2026-48824
·
Published
2026-07-01
·
Updated
2026-07-30
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Mailpit versions prior to 1.30.1
Description
An incomplete fix for a previous denial-of-service issue left several API endpoints without body-size limits. An unauthenticated remote attacker can send a specially crafted JSON request containing a multi-million-element
IDs slice to exhaust system memory (RSS), leading to a denial-of-service. This memory amplification occurs because the application calls json.NewDecoder(r.Body) directly without a size cap, causing the memory usage to grow linearly with the payload size.API Endpoints:
PUT /api/v1/messages(SetReadStatus)DELETE /api/v1/messages(DeleteMessages)PUT /api/v1/tags(SetMessageTags)POST /api/v1/message/{id}/release(ReleaseMessage)
Vulnerable Parameters or Variables:
IDs
Recommendations
Update Mailpit to version 1.30.1 or later.
As a temporary workaround, restrict access to the affected API endpoints to trusted networks to minimize the risk of unauthenticated exploitation.
Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mailpit