CVE-2026-23829: axllent mailpit CRLF Injection

Vulnerability summary

CVE-2026-23829 is a medium (CVSS 5.3) CRLF Injection vulnerability in axllent mailpit. EPSS estimates a 1.40% chance of exploitation in the next 30 days, higher than 72.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-01-2026
   PublishedVulnerability first disclosed.
2. 20-01-2026
   Last modifiedVulnerability information updated.

Description

Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
• CWE-150Improper Neutralization of Escape, Meta, or Control SequencesThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.