PT-2026-79204 · Mailpit · Mailpit
CVE-2026-67447
·
Published
2026-08-20
·
Updated
2026-09-04
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Mailpit versions 1.30.0 through 1.30.4
Description
An unauthenticated SMTP client can cause substantial memory pressure by sending a single line that exceeds the configured
MaxMessageSize. This occurs because the readData() function in internal/smtpd/smtpd.go calls bufio.Reader.ReadBytes before validating the combined size of data and line against Server.MaxSize. Consequently, the full line is allocated in memory before the system returns a 552 5.3.4 rejection.Recommendations
Update to version 1.30.5.
Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mailpit