CVE-2026-67446

Mailpit , an email testing tool and API for developers, is vulnerable to a memory exhaustion issue in its thumbnail generation endpoint (GET /api/v1/message/{id}/part/{partID}/thumb). The handler in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation on attacker-supplied image ...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

EUVD-2026-63659

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

PT-2026-79137

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.30.4 Description An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout occurs. This happens because the software reads SMTP comman...

PT-2026-79138

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

PT-2026-79205

Name of the Vulnerable Software and Affected Versions Mailpit versions 1.29.0 through 1.30.5 Description An issue exists where the origin middleware in server/server.go checks the raw RequestURI for the /api/ prefix, while Go's ServeMux routes using the percent-decoded URL path. Additionally,...

PT-2026-79204

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: seaweedfs-fips, bento-fips, fortio-fips, seaweedfs, seaweedfs-operator-fips, rclone-fips, mattermost-fips, pdfcpu, bento, kitty, fortio, nemo, seaweedfs-operator, kubescape, seaweedfs-rocksdb, gitea, seaweedfs-rocksdb-fips, mailpit-fips, mattermost, gitea-fips, rclon...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: bento, kubescape, mailpit, seaweedfs, ollama, gitea, pdfcpu, mattermost, rclone, kitty...

CVE-2026-46603 vulnerabilities

Vulnerabilities for packages: bento, kubescape, mailpit, seaweedfs, ollama, gitea, pdfcpu, mattermost, rclone, kitty...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, listmonk, hugo, rclone-fips, hugo-extended, seaweedfs-fips, ollama, mattermost-fips, mailpit, hugo-fips, ollama-fips, mailpit-fips, mattermost, seaweedfs, seaweedfs-operator, rclone...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, listmonk, hugo, rclone-fips, seaweedfs-rocksdb, hugo-extended, seaweedfs-fips, gitlab-workhorse-ce, mattermost-fips, seaweedfs-rocksdb-fips, filebrowser, mailpit, hugo-fips, mailpit-fips, mattermost, seaweedfs, seaweedfs-operator, rclone...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: hugo, hugo-extended, mailpit, seaweedfs, ollama, rclone, mattermost...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: hugo, hugo-extended, mailpit, seaweedfs, filebrowser, rclone, mattermost...

GO-2026-5061 vulnerabilities

Vulnerabilities for packages: bento, kubescape, mailpit, seaweedfs, ollama, gitea, pdfcpu, mattermost, rclone...

CLEANSTART-2026-JR76214 Security fixes in mailpit 1.30.3-r1

Package mailpit version 1.30.3-r1 fixes 1 vulnerabilities: CVE-2026-56852...

SUSE CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit v1.28.3, hardened internal/htmlcheck/css.go::downloadCSSToBytes with a 5MB size cap, a text/css content-type check,...

SUSE CVE-2026-45711

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http sub-command downloads every message from a remote Mailpit instance and writes each one as .eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON...

SUSE CVE-2026-45712

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy /proxy?data=... maintains a package-level assets mapstringMessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and re-entrant...