CVE-2026-67447: axllent mailpit

Vulnerability summary

CVE-2026-67447 is a medium (CVSS 5.3) vulnerability in axllent mailpit. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities.

Timeline

1. 20-08-2026
   PublishedVulnerability first disclosed.
2. 21-08-2026
   Last modifiedVulnerability information updated.

Description

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.