CVE-2026-67446: Uncontrolled Resource Consumption

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-67447: Allocation of Resources Without Limits or Throttling

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...

CVE-2026-67445: Uncontrolled Resource Consumption

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine using bufio.Reader.ReadString before session.parseLine parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticate...

PT-2026-79204

Name of the Vulnerable Software and Affected Versions Mailpit versions 1.30.0 through 1.30.4 Description An unauthenticated SMTP client can cause substantial memory pressure by sending a single line that exceeds the configured MaxMessageSize. This occurs because the readData function in...

PT-2026-79205

Name of the Vulnerable Software and Affected Versions Mailpit versions 1.29.0 through 1.30.5 Description An issue exists where the origin middleware in server/server.go checks the raw RequestURI for the /api/ prefix, while Go's ServeMux routes using the percent-decoded URL path. Additionally,...

PT-2026-79138

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.30.4 Description Mailpit decodes image attachments into a full raster before verifying decoded dimensions, pixel count, or memory usage. This occurs in the GET '/api/v1/message/id/part/partID/thumb' endpoint. The...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: bento, mailpit, rclone-fips, ollama, mailpit-fips, ollama-fips, gitea-fips, bento-fips, seaweedfs, pdfcpu, mattermost, fortio, seaweedfs-operator-fips, gitea, seaweedfs-operator, fortio-fips, mattermost-fips, rclone, kubescape, seaweedfs-fips, kubescape-server-fips,...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: kitty, ollama, gitea, mattermost, seaweedfs, kubescape, pdfcpu, bento, mailpit, rclone...

CVE-2026-46603 vulnerabilities

Vulnerabilities for packages: kitty, ollama, gitea, mattermost, seaweedfs, kubescape, pdfcpu, bento, mailpit, rclone...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: listmonk, seaweedfs-fips, seaweedfs-operator, seaweedfs, hugo-extended, mailpit, mattermost, mattermost-fips, rclone-fips, hugo-fips, hugo, ollama, seaweedfs-operator-fips, mailpit-fips, rclone, ollama-fips...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: listmonk, seaweedfs-fips, seaweedfs-operator, seaweedfs, hugo-extended, filebrowser, mailpit, mattermost, mattermost-fips, rclone-fips, seaweedfs-operator-fips, seaweedfs-rocksdb, hugo-fips, seaweedfs-rocksdb-fips, hugo, gitlab-workhorse-ce, mailpit-fips, rclone...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: ollama, mattermost, seaweedfs, hugo-extended, hugo, mailpit, rclone...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: mattermost, seaweedfs, hugo-extended, hugo, mailpit, rclone, filebrowser...

GO-2026-5061 vulnerabilities

Vulnerabilities for packages: ollama, mattermost, gitea, seaweedfs, kubescape, pdfcpu, bento, mailpit, rclone...

CLEANSTART-2026-JR76214 Security fixes in mailpit 1.30.3-r1

Package mailpit version 1.30.3-r1 fixes 1 vulnerabilities: CVE-2026-56852...

SUSE CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit v1.28.3, hardened internal/htmlcheck/css.go::downloadCSSToBytes with a 5MB size cap, a text/css content-type check,...

SUSE CVE-2026-45711

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http sub-command downloads every message from a remote Mailpit instance and writes each one as .eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON...

SUSE CVE-2026-45712

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy /proxy?data=... maintains a package-level assets mapstringMessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and re-entrant...

SUSE CVE-2026-45713

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

SUSE CVE-2026-48824

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...