CVE-2026-67445 in Mailpit
Summary
by MITRE • 08/21/2026
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/21/2026
Mailpit serves as a specialized email testing tool and API designed for developers to inspect and manage incoming emails during the software development lifecycle. While primarily intended for local or internal testing environments, its SMTP server component processes commands from remote clients using standard protocols defined in RFC 5321. A critical vulnerability exists within the command parsing logic prior version 1.30.4, specifically involving how the application handles input data before enforcing protocol limits. The core issue stems from a race condition or ordering flaw in the SMTP session handling code located in internal/smtpd/smtpd.go. Specifically, the function readLine() utilizes bufio.Reader.ReadString to allocate memory for incoming command lines prior to invoking parseLine(), which is responsible for validating syntax and enforcing length constraints such as the 512-octet limit mandated by RFC 5321.
This architectural sequencing creates a significant resource exhaustion vector because the system allocates buffer space based on the input size before verifying whether that size exceeds acceptable thresholds. An unauthenticated remote SMTP client can exploit this flaw by sending an oversized single command line. Since the memory is fully allocated during the read phase, the application consumes substantial resources even if the command would ultimately be rejected for being too long or syntactically invalid. This bypasses normal protections such as MaxMessageSize and DATA limits, which are typically enforced later in the transaction flow after the initial command parsing stage. Consequently, attackers can trigger disproportionate memory consumption relative to the effort required to send a single malformed packet.
The vulnerability extends beyond simple SMTP commands to include authentication mechanisms. The same command reader is utilized by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() for processing continuation lines during the authentication handshake. This means that concurrent oversized inputs targeting these authentication methods can create severe memory pressure on the server. In a multi-threaded or high-concurrency environment, multiple clients sending large payloads simultaneously can rapidly deplete available system resources. This leads to degraded service performance and potentially causes a denial of service condition where legitimate users are unable to connect or send emails due to resource starvation.
From a classification perspective, this vulnerability aligns with CWE-400: Uncontrolled Resource Consumption, as the application fails to limit the amount of resources consumed by an attacker-controlled input. It also relates to CWE-787: Out-of-bounds Write if the allocation leads to buffer overflows in specific implementations, though primarily it is a resource exhaustion issue. In terms of MITRE ATT&CK framework tactics, this falls under Impact and potentially Initial Access depending on whether the denial of service prevents legitimate administrative actions or security monitoring capabilities. The lack of pre-validation before memory allocation represents a fundamental design flaw common in systems that prioritize throughput over strict input sanitization at early stages.
Mitigation for this vulnerability requires upgrading to Mailpit version 1.30.4, which addresses the ordering issue by ensuring that length checks and syntax validations occur prior to or during buffer allocation rather than after full memory commitment. For organizations unable to upgrade immediately, deploying a reverse proxy or firewall rule that limits SMTP command line sizes can provide an external layer of defense. Additionally, configuring connection timeouts and rate limiting on the SMTP port can help mitigate the impact of concurrent attacks by reducing the window in which resource exhaustion occurs. Regular security audits focusing on input validation ordering are recommended to prevent similar issues in other network-facing services where early-stage memory allocation precedes content verification.