CVE-2026-67445

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.30.4

Description An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout occurs. This happens because the software reads SMTP commands through the readLine() function in internal/smtpd/smtpd.go using bufio.Reader.ReadString before the parseLine() function parses the verb or enforces the RFC 5321 512-octet command-line limit. Since the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path, and the same command reader is used by the handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, concurrent oversized inputs can create memory pressure and reduce service availability.

Recommendations Update to version 1.30.4.