Mailpit < 1.28.3 - Server-Side Request Forgery

Mailpit = 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests. id: CVE-2026-21859 info: name: Mailpit 1.28.3 -...

CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover

🎯 CTT-Mailpit-Exploit：完美 11/10 分零点击蠕虫 利用收敛时间理论（Convergent Time Theory），将基础的 SMTP 头注入漏洞（CVE-2026-23829）转化为一个满分、自传播的 RCE 蠕虫。 📊 分数转化：6.1 → 11.0/10 ⭐ 指标| 原始（CVE-2026-23829）| CTT 增强| 提升 ---|---|---|--- CVSS 分数| 6.1/10（中危）| 11.0/10 ⭐| +4.9 攻击向量| 网络| 时间共振| +2.0 影响| 头欺骗| 完整 RCE + 蠕虫| +3.9 用户交互| 无| 负（零点击）...

-CVE-2026-23829-CTT-Mailpit-phase-reconstruction-

SimoesCTT-mailpit-phase-reconstructor 这是 Mailpit SMTP 服务器中的一个 CRLF 注入漏洞——一个经典的数据损坏漏洞。但在 CTT 视角下，它不仅仅是一个 bug，更是一次相位重建的机遇。 CVE-2026-23829 CTT-Mailpit-Phase-Reconstructor CVE-2026-23829 — 新物理学的证明 --- ⚡ 摘要 本仓库旨在证明 CVE-2026-23829（Mailpit SMTP 服务器中的 CRLF 注入漏洞）不仅仅是一个软件缺陷——它是一扇通往新物理学的窗口。 利用收敛时间理论（CTT）和基本...

FreeBSD : mailpit -- Multi-frame animation bypass of thumbnail pixel budget (c1980e14-b424-11f1-bd9f-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c1980e14-b424-11f1-bd9f-10ffe07f9334 advisory. Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 Thumbnail generation decodes...

mailpit -- Multi-frame animation bypass of thumbnail pixel budget

Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 "Thumbnail generation decodes unbounded image dimensions before scaling", patched in v1.30.4 bounds only the width × height of a single frame. The decoded-size budget is still not enforced over frame count, so an animated PN...

CLEANSTART-2026-HU95465 Security fix for CVE-2026-33813 applied in: gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, mailpit 1.29.6-r0, mailpit 1.29.7-r1, mailpit-fips 1.29.6-r0, mailpit-fips 1.29.7-r1, ollama 0.20.3-r1, ollama 0.30.10-r0, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.18.3-r0, ollama-fips 0.21.0-r0, ollama-fips 0.30.11-r1, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-33813 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LM41855 Security fix for CVE-2026-33812 applied in: gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, mailpit 1.29.6-r0, mailpit-fips 1.29.6-r0, ollama 0.20.3-r1, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.18.3-r0, ollama-fips 0.21.0-r0, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-33812 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SN47356 Security fix for CVE-2026-46599 applied in: gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, ollama 0.20.3-r4, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.18.3-r2, ollama-fips 0.21.0-r3, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-46599 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BZ94585 Security fix for CVE-2026-46601 applied in: mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, ollama 0.23.4-r2, ollama 0.30.10-r0, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.30.11-r1, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-46601 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BV44413 Security fix for CVE-2026-46604 applied in: mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.30.11-r1, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-46604 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CA42372 norm

Multiple security vulnerabilities affect the mailpit package. A norm. See references for individual vulnerability details...

GO-2026-6363 Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection in github.com/axllent/mailpit

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection in github.com/axllent/mailpit...

GO-2026-6359 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling in github.com/axllent/mailpit

Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling in github.com/axllent/mailpit...

SUSE CVE-2026-67447

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...

SUSE CVE-2026-67448

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-67446

creationtimestamp| type| source ---|---|--- 2026-09-03 00:35:04+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39 2026-09-03 07:31:59+00:00| seen| https://gist.github.com/alon710/3dcd56ab41cf2fc234bc88855814c85c...

CVE-2026-67445

creationtimestamp| type| source ---|---|--- 2026-09-03 00:35:02+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v 2026-09-03 05:32:21+00:00| seen| https://gist.github.com/alon710/25d950fb1b775a5961200e6e2792284d...

EUVD-2026-63663

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection...

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...

GHSA-W878-PJ84-3J5V Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...