axllent Mailpit up to 1.30.3 smtpd internal/smtpd/smtpd.go readLine allocation of resources

Summaryinfo

A vulnerability, which was classified as problematic, has been found in axllent Mailpit up to 1.30.3. Affected by this vulnerability is the function readLine of the file internal/smtpd/smtpd.go of the component smtpd. This manipulation causes allocation of resources. This vulnerability is tracked as CVE-2026-67445. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in axllent Mailpit up to 1.30.3. Affected by this vulnerability is the function readLine of the file internal/smtpd/smtpd.go of the component smtpd. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-67445 since 07/29/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 1.30.4 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• axllent

Name

• Mailpit

Version

• 1.30.0
• 1.30.1
• 1.30.2
• 1.30.3

Website

• Product: https://github.com/axllent/mailpit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion