Mailpit SMTP server crashes on long emails

Published September 2, 2026 CVE-2026-67445

Mailpit, a tool developers use to test outgoing email during development, can be knocked offline by a flaw in how it reads incoming SMTP commands. A remote sender can overload it with oversized data before it even checks that the command makes sense, using up memory and making it stop responding.

Severity
MediumCVSS 3.1 · 5.3
Fix
Fixed in 1.30.4Fix recorded on Sep 2, 2026
Affected versions
1.30.3 or older
Weakness
CWE-400Uncontrolled Resource Consumption
Exploit likelihood
0.38% in 30 daysEPSS, higher than 31% of known flaws
Affects
axllent/mailpit

How it works

Mailpit reads each incoming SMTP command line into memory in one unbroken chunk before checking its length or contents, so a sender can keep streaming data on a single line with no size cap until the server runs low on memory.

What to do

Check the running Mailpit version in its web UI footer or with the mailpit --version command, and confirm whether its SMTP port (default 1025) is reachable from outside your trusted network.

Update to Mailpit 1.30.4 or later, which enforces the SMTP command-line length limit before buffering, and until then avoid exposing the SMTP port to untrusted networks.

Technical details

Affected software: axllent/mailpit

Mailpit's SMTP session reader calls bufio. Reader.ReadString to pull each command line before session.parseLine checks the verb or enforces the RFC 5321 512-octet command-line limit. An unauthenticated client can send one oversized line pre-DATA, bypassing MaxMessageSize and DATA limits entirely, and the same unbounded reader backs the AUTH LOGIN, AUTH PLAIN, and AUTH CRAM-MD5 continuation paths, so concurrent oversized lines add up memory pressure. Fixed in 1.30.4 by enforcing the length limit before buffering completes.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Open in FIRST.org calculator

References

View Original Source