CVE-2026-45709

Mailpit’s CVE-2026-45709 vulnerability stems from an incomplete fix for GHSA-6jxm. While v1.28.3 hardened CSS download with size cap, content-type check, and login-info stripping, the internal htmlcheck CSS downloader (internal/htmlcheck/css.go) did not implement an IP-filtering dialer. The safeD...