Executive brief
Mailpit's SMTP server reads incoming command lines into memory without enforcing RFC 5321's 512-octet limit, allowing unauthenticated remote attackers to force excessive heap allocation by sending oversized single commands. By repeating this across multiple connections, an attacker can exhaust server memory and disrupt email processing and availability.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-400) in Mailpit's SMTP command handling. The `readLine()` function in `internal/smtpd/smtpd.go` uses `bufio.Reader.ReadString('\n')` to read commands without enforcing a maximum length, buffering the entire attacker-supplied line into heap memory before any command validation occurs. This violates RFC 5321 section 4.5.3.1.4, which mandates a 512-octet limit for SMTP command lines. An unauthenticated attacker with network access to the SMTP listener (default `[::]:1025`) can send multi-megabyte command lines repeatedly across concurrent connections to consume process memory and trigger denial of service. The DATA message-size limit (`MaxMessageSize`, default 50 MiB) does not protect against this, as the vulnerability exists in pre-DATA command processing. Patch version 1.30.4 is available; all prior versions including v1.30.3 and develop are affected.
Affected products
- Axllent Mailpit <= 1.30.3
Timeline
- 2026-07-09: disclosed
- 2026-09-02: advisory
- 2026-09-02: patched: Fixed in version 1.30.4