Executive brief
Mailpit is a tool used by developers to test email functionality during software development. A security flaw allows an unauthenticated attacker to send massive amounts of data to the tool, which can crash the service by consuming all available system memory. This results in a denial of service, preventing developers from testing their applications until the tool is restarted.
Technical details
Mailpit prior to version 1.30.0 contains a resource exhaustion vulnerability (CWE-400/CWE-770). The SMTP server component includes a 'Server.MaxSize' field intended to limit DATA payloads, but this field was never initialized outside of test code, defaulting to 0 (no limit). Similarly, the HTTP '/api/v1/send' endpoint lacks a 'MaxBytesReader' implementation. An unauthenticated remote attacker can transmit arbitrarily large payloads, which undergo a 7-10x memory amplification during processing (parsing and indexing), leading to an Out-of-Memory (OOM) kill. Version 1.30.0 fixes this by introducing a default 50MB message size limit.
Affected products
- axllent Mailpit < 1.30.0
Timeline
- 2026-05-14: patched: Version 1.30.0 released with fix
- 2026-05-14: advisory: GitHub Security Advisory GHSA-fpxj-m5q8-fphw published
- 2026-07-20: disclosed: CVE-2026-45713 published to NVD