Mailpit image bug can crash the email-testing tool

Published September 2, 2026 CVE-2026-67446

Mailpit, a tool developers use to test outgoing email, can be knocked offline by a booby-trapped image attachment. A small image file that claims huge pixel dimensions forces Mailpit to expand it in memory before shrinking it, which can exhaust server memory and CPU and make Mailpit stop responding.

Severity
MediumCVSS 3.1 · 5.3
Fix
Fixed in 1.30.4Fix recorded on Sep 2, 2026
Affected versions
1.30.3 or older
Weakness
CWE-400Uncontrolled Resource Consumption
Exploit likelihood
0.37% in 30 daysEPSS, higher than 30% of known flaws
Affects
axllent/mailpit

How it works

Mailpit's thumbnail feature reads an image attachment and fully unpacks it into raw pixels before checking its declared width and height, so a tiny file that claims enormous dimensions still gets expanded in full before Mailpit shrinks it down to a small preview.

What to do

Check the running Mailpit version; if it is 1.30.3 or older and its web API or UI is reachable by anyone who can also deliver mail to it, it is affected.

Update to Mailpit 1.30.4 or later, where thumbnail generation checks image dimensions before decoding. Until updated, avoid exposing Mailpit's web API to untrusted senders or networks.

Technical details

Affected software: axllent/mailpit

The GET /api/v1/message/{id}/part/{partID}/thumb endpoint in server/apiv1/thumbnails.go calls imaging. Decode on attacker-supplied attachment bytes with AutoOrientation enabled, before any check on decoded pixel count, dimensions, or estimated memory footprint. Only after full decode does it call imaging.

Fill to produce a fixed 180x120 output, so a compact PNG with inflated declared dimensions forces disproportionate memory and CPU use. The same code path is reachable from the message UI via MessageAttachments.vue. Fixed in 1.30.4. CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), availability impact only.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Open in FIRST.org calculator

References

View Original Source