Is CVE-2026-45713 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45713 being exploited in the wild.

How severe is CVE-2026-45713?

High severity, with a CVSS score of 7.5, published 20 July 2026.

Which products and versions are affected?

Axllent Mailpit < 1.30.0; github.com/axllent/mailpit (Go) < 1.30.0, SEMVER:introduced=0,fixed=1.30.0.

Is there a fix for CVE-2026-45713?

Yes. github.com/axllent/mailpit (Go): upgrade to 1.30.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45713 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45713?

Check whether you run Axllent Mailpit or github.com/axllent/mailpit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45713: axllent Mailpit denial of service via unbounded message size

Q: Which products and versions are affected?

Axllent Mailpit < 1.30.0; github.com/axllent/mailpit (Go) < 1.30.0, SEMVER:introduced=0,fixed=1.30.0.

Q: Is there a fix for CVE-2026-45713?

Yes. github.com/axllent/mailpit (Go): upgrade to 1.30.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45713 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-45713?

Check whether you run Axllent Mailpit or github.com/axllent/mailpit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45713 · Severity: high · CVSS 7.5 · Published 2026-07-20

Mailpit is a tool used by developers to test email functionality during software development. A security flaw allows an unauthenticated attacker to send massive amounts of data to the tool, which can crash the service by consuming all available system memory. This results in a denial of service, preventing developers from testing their applications until the tool is restarted.

Technologies: Axllent Mailpit, github.com/axllent/mailpit (Go). Vendors: Axllent, Go.

Quick answers

Is CVE-2026-45713 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45713 being exploited in the wild.
How severe is CVE-2026-45713?: High severity, with a CVSS score of 7.5, published 20 July 2026.
Which products and versions are affected?: Axllent Mailpit < 1.30.0; github.com/axllent/mailpit (Go) < 1.30.0, SEMVER:introduced=0,fixed=1.30.0.
Is there a fix for CVE-2026-45713?: Yes. github.com/axllent/mailpit (Go): upgrade to 1.30.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45713 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45713?: Check whether you run Axllent Mailpit or github.com/axllent/mailpit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/axllent/mailpit (Go): upgrade to 1.30.0 or later
```
go get github.com/axllent/mailpit@v1.30.0
```

Technical details

Mailpit prior to version 1.30.0 contains a resource exhaustion vulnerability (CWE-400/CWE-770). The SMTP server component includes a 'Server.MaxSize' field intended to limit DATA payloads, but this field was never initialized outside of test code, defaulting to 0 (no limit). Similarly, the HTTP '/api/v1/send' endpoint lacks a 'MaxBytesReader' implementation. An unauthenticated remote attacker can transmit arbitrarily large payloads, which undergo a 7-10x memory amplification during processing (parsing and indexing), leading to an Out-of-Memory (OOM) kill. Version 1.30.0 fixes this by introducing a default 50MB message size limit.

Affected products

axllent Mailpit < 1.30.0

Identifiers

CVE-2026-45713
GHSA-fpxj-m5q8-fphw
GO-2026-5376

Timeline

2026-05-14: patched: Version 1.30.0 released with fix
2026-05-14: advisory: GitHub Security Advisory GHSA-fpxj-m5q8-fphw published
2026-07-20: disclosed: CVE-2026-45713 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.