CVE-2026-67446

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.30.4

Description Mailpit decodes image attachments into a full raster before verifying decoded dimensions, pixel count, or memory usage. This occurs in the GET '/api/v1/message/{id}/part/{partID}/thumb' endpoint. The Thumbnail handler in server/apiv1/thumbnails.go uses storage.GetAttachmentPart() to obtain bytes and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image. A compact image with declared large dimensions can cause excessive memory and CPU consumption, potentially degrading availability. This can be triggered by an unauthenticated client storing a crafted attachment or by opening the message UI via server/ui-src/components/message/MessageAttachments.vue.

Recommendations Update to version 1.30.4.