CVE-2026-45712 in Mailpit
Summary
by MITRE • 07/20/2026
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go's runtime raises fatal error: concurrent map read and map write — a runtime.throw that is not recoverable by http.Server's handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it. Version 1.30.0 contains a patch.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability represents a critical concurrency issue in Mailpit's screenshot proxy functionality that can lead to complete application crashes. The flaw exists in the /proxy endpoint which maintains a package-level cache of message assets using a map[string]MessageAssets data structure. The root cause stems from improper synchronization practices where the read operations on this shared map occur without acquiring the necessary assetsMutex lock, while concurrent write operations from both a long-running cleanup goroutine and a re-entrant CSS-rewriting code path execute under the protection of the same mutex. This creates a classic race condition scenario where unsynchronized reads happen simultaneously with synchronized writes, violating Go's memory model and resulting in the fatal runtime error "concurrent map read and map write" that terminates the entire Mailpit process.
The operational impact of this vulnerability is severe as it affects the core functionality of Mailpit's email testing capabilities. When the race condition occurs during active usage, particularly when processing screenshot requests combined with cleanup operations or CSS rewriting processes, the Go runtime throws an unrecoverable fatal error that causes the complete termination of the Mailpit application. This means all network listeners including SMTP, POP3, and HTTP services are abruptly shut down, effectively rendering the entire email testing tool unavailable to developers who rely on it for their testing workflows. The vulnerability is particularly dangerous because it cannot be recovered from within the HTTP handler context due to the nature of the runtime error, making it a system-wide failure rather than an isolated request processing issue.
This concurrency flaw aligns with CWE-367, which addresses time-of-check to time-of-use (TOCTOU) vulnerabilities, and specifically manifests as a race condition in shared data access patterns. The vulnerability also maps to ATT&CK technique T1499.004, representing network denial of service through resource exhaustion or application crashes, since the flaw can be exploited to cause complete service outages. Additionally, it demonstrates characteristics of CWE-1173, which concerns improper handling of shared resources in concurrent programming environments, where proper synchronization mechanisms are not applied consistently across all access patterns to shared data structures.
The remediation implemented in version 1.30.0 addresses the fundamental synchronization issue by ensuring that all read operations on the assets map occur under the protection of assetsMutex, thereby preventing the race condition between concurrent readers and writers. This change aligns with industry best practices for concurrent programming in Go and ensures proper mutual exclusion across all access patterns to the shared message assets cache. The fix prevents the fatal runtime errors by ensuring that no unsynchronized reads can occur during write operations, maintaining application stability while preserving the intended functionality of the screenshot proxy feature.