FreeBSD : mail/mailpit -- memory-exhaustion DoS via unbounded JSON body (7ae38fde-5ab6-11f1-a242-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7ae38fde-5ab6-11f1-a242-10ffe07f9334 advisory. Mailpit author reports: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on...

GHSA-FPXJ-M5Q8-FPHW Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

Summary The Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". The same applies to the HTTP /api/v1/send endpoint, whose request body is...

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

Summary The Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". The same applies to the HTTP /api/v1/send endpoint, whose request body is...

GHSA-W4VJ-R5PG-3722 Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

Summary The screenshot/print proxy /proxy?data=… maintains a package-level assets mapstringMessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and re-entrant CSS-rewriting code path concurrently write to it under the lock. When the...

Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

Summary The screenshot/print proxy /proxy?data=… maintains a package-level assets mapstringMessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and re-entrant CSS-rewriting code path concurrently write to it under the lock. When the...

GHSA-QX5X-85P8-VG4J Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

Summary The mailpit dump --http sub-command downloads every message from a remote Mailpit instance and writes each one as .eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with...

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

Summary The mailpit dump --http sub-command downloads every message from a remote Mailpit instance and writes each one as .eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with...

GHSA-J3FJ-QPPJ-FMMC Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

Summary The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit v1.28.3, hardened internal/htmlcheck/css.go::downloadCSSToBytes with a 5MB size cap, a text/css content-type check, login-info stripping in isValidURL, and an opt-in...

PT-2026-41965

Name of the Vulnerable Software and Affected Versions mailpit versions prior to v1.28.3 mailpit versions v1.28.3 and later Description An incomplete fix for a previous issue allows a Server-Side Request Forgery SSRF via the HTML Check API. While previous updates added size limits and content-type...

PT-2026-41966

Name of the Vulnerable Software and Affected Versions Mailpit affected versions not specified Description The dump --http sub-command allows an arbitrary file write via path traversal. When downloading messages from a remote server, the tool uses the message ID from the JSON response to construct...

PT-2026-41967

Name of the Vulnerable Software and Affected Versions Mailpit affected versions not specified Description A remote, unauthenticated attacker can cause a denial of service DoS by crashing the Mailpit process. The issue occurs because the screenshot/print proxy reads a package-level assets cache...

PT-2026-41968

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.30.0 Description Unauthenticated remote attackers can cause a denial of service DoS by sending arbitrarily large messages via the SMTP server or the HTTP API. The SMTP server fails to assign a value to the...

CLEANSTART-2026-XM69713 Security fixes for CVE-2026-33812, CVE-2026-33813 applied in versions: 1.29.6-r0

Multiple security vulnerabilities affect the mailpit-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CF88804 Security fixes for CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499 applied in versions: 1.29.7-r0

Multiple security vulnerabilities affect the mailpit package. These issues are resolved in later releases. See references for individual vulnerability details...

FreeBSD : mail/mailpit -- multiple vulnerabilities (6e701ad2-4f61-11f1-af6d-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6e701ad2-4f61-11f1-af6d-10ffe07f9334 advisory. Mailpit author reports: Set a default 50MB per message limit to prevent DoS via unlimited SMTP...

CVE-2026-45711

creationtimestamp| type| source ---|---|--- 2026-05-14 04:53:32+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j...

CVE-2026-45713

creationtimestamp| type| source ---|---|--- 2026-05-14 04:53:02+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-fpxj-m5q8-fphw 2026-07-20 17:01:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3ri4xgy22g...

mail/mailpit -- multiple vulnerabilities

Mailpit author reports: Set a default 50MB per message limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes GHSA-fpxj-m5q8-fphw Include CGNAT Carrier-Grade NAT in internal IP checks GHSA-j3fj-qppj-fmmc Block internal IP access by default in HTML check GHSA-j3fj-qppj-fmmc Fix f...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, pulumi-language-yaml, wal-g, cluster-autoscaler, scorecard, aws-flb-firehose, newrelic-fluent-bit-output-fips, rancher-agent, nats-server, beats, amazon-ecs-cni-plugins-fips, libnvidia-container-fips, harbor-fips, helm-exporter, flux-operator-fips,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, pulumi-language-yaml, wal-g, cluster-autoscaler, scorecard, aws-flb-firehose, newrelic-fluent-bit-output-fips, rancher-agent, nats-server, beats, amazon-ecs-cni-plugins-fips, libnvidia-container-fips, harbor-fips, helm-exporter, flux-operator-fips,...