CVE-2026-67447: fallo de gravedad media en axllent mailpit
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.5%
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
axllent · mailpitCVEs relacionadas — axllent mailpit
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-23829MEDIUMMailpit has SMTP Header Injection via Regex BypassEPSS 1.4%CVE-2026-21859MEDIUMMailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)EPSS 0.8%CVE-2026-45713HIGHMailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizesEPSS 0.6%CVE-2026-48824MEDIUMMailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)EPSS 0.5%CVE-2026-27808MEDIUMMailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check APIEPSS 0.5%CVE-2026-67445MEDIUMMailpit: SMTP command parser buffers unbounded command lines before syntax rejectionEPSS 0.5%