CVE-2026-45712: axllent mailpit Race Condition

Vulnerability summary

CVE-2026-45712 is a medium (CVSS 5.9) Race Condition vulnerability in axllent mailpit. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-07-2026
   PublishedVulnerability first disclosed.
2. 20-07-2026
   Last modifiedVulnerability information updated.

Description

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go's runtime raises fatal error: concurrent map read and map write — a runtime.throw that is not recoverable by http.Server's handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it. Version 1.30.0 contains a patch.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.