Executive brief
Mailpit is an email testing tool with an SMTP server enabled by default. The SMTP server improperly validates message size limits by buffering entire lines into memory before checking the size cap. An attacker can send oversized SMTP DATA lines without authentication to force excessive memory allocation, potentially exhausting server resources and causing denial of service to legitimate mail operations.
Technical details
The vulnerability exists in the SMTP DATA reader's size-enforcement logic. The code calls bufio.Reader.ReadBytes('\n') to read a complete line before checking if len(data)+len(line) exceeds srv.MaxSize. This ordering allows an attacker to cause the full oversized line to be buffered into memory before the size limit is enforced. An unauthenticated remote client can reach the SMTP listener and exploit this with a 64 MiB single DATA line on a default 50 MiB size limit, allocating ~130 MiB of memory before receiving rejection. The issue was introduced after an earlier patch that assigned srv.MaxSize; multi-line messages are bounded, but individual oversized lines bypass the check. No patch has been released as of the advisory date.
Affected products
- Mailpit Mailpit >=1.30.0, <1.30.5
Timeline
- 2026-07-20: disclosed: Vulnerability details published via GHSA-r553-m4fv-5v97
- 2026-07-09: other: Vulnerability confirmed in v1.30.4 release and develop branch
- 2026-09-02: patched: Fix included in v1.30.5 release