5.3

CVE-2026-67445: axllent mailpit Uncontrolled Resource Consumption

CVSS: 5.3v3.1MediumDeferred
AliasesGHSA-w878-pj84-3j5vGO-2026-6363
Published 20-08-2026Last modified 21-08-2026
Open JSON

Vulnerability summary

CVE-2026-67445 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in axllent mailpit. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.51%
0%100%
Low · +0.13 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
OPENSUSE-SU-2026:21897-1SUSE-SU-2026:23855-1SUSE-SU-2026:23863-1

Timeline

  1. 20-08-2026
    PublishedVulnerability first disclosed.
  2. 21-08-2026
    Last modifiedVulnerability information updated.

Description

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

42%

Versus all other CVEs

30-day change

+0.13 pp

From 0.38% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Axllent1 product
Github.com/axllent1 product
  • mailpit< 1.30.4

2 vendors · 2 products

References

5 links