Executive brief
Mailpit is an email testing tool used by developers to capture and view outgoing emails during software development. A flaw in how the tool handles internal data allows a remote attacker to crash the entire application by sending specifically crafted requests. This results in a total service outage, preventing developers from receiving or testing emails until the process is manually restarted.
Technical details
A race condition exists in the Mailpit screenshot/print proxy (/proxy?data=...) due to improper synchronization of a package-level assets map. The application performs unsynchronized reads on the map while a background cleanup goroutine and CSS-rewriting logic perform synchronized writes. Because Go's runtime raises a non-recoverable fatal error upon detecting concurrent map access, the entire Mailpit process terminates, including SMTP, POP3, and HTTP listeners. An unauthenticated attacker can trigger this by planting a message with a stylesheet link and issuing concurrent requests to the proxy endpoint. The issue is fixed in version 1.30.0.
Affected products
- axllent Mailpit < 1.30.0
Timeline
- 2026-05-14: patched: Version 1.30.0 released
- 2026-07-20: disclosed: CVE-2026-45712 published