Mailpit < 1.28.3 - Server-Side Request Forgery

Mailpit = 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests. id: CVE-2026-21859 info: name: Mailpit 1.28.3 -...

CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover

🎯 CTT-Mailpit-Exploit: Puntuación Perfecta 11/10 Gusano Zero-Click Transforma una inyección básica de cabecera SMTP CVE-2026-23829 en un gusano RCE autopropagante con puntuación perfecta utilizando la Teoría del Tiempo Convergente. 📊 Transformación de Puntuación: 6.1 → 11.0/10 ⭐ Métrica Original...

-CVE-2026-23829-CTT-Mailpit-phase-reconstruction-

SimoesCTT-mailpit-phase-reconstructor Es una inyección CRLF en el servidor SMTP de Mailpit: una vulnerabilidad clásica de corrupción de datos. Pero bajo CTT, no es solo un bug. Es una oportunidad de reconstrucción de fase. CVE-2026-23829 CTT-Mailpit-Phase-Reconstructor CVE-2026-23829 — Prueba de...

FreeBSD : mailpit -- Multi-frame animation bypass of thumbnail pixel budget (c1980e14-b424-11f1-bd9f-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c1980e14-b424-11f1-bd9f-10ffe07f9334 advisory. Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 Thumbnail generation decodes...

mailpit -- Multi-frame animation bypass of thumbnail pixel budget

Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 "Thumbnail generation decodes unbounded image dimensions before scaling", patched in v1.30.4 bounds only the width × height of a single frame. The decoded-size budget is still not enforced over frame count, so an animated PN...

CLEANSTART-2026-HU95465 Security fix for CVE-2026-33813 applied in: gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, mailpit 1.29.6-r0, mailpit 1.29.7-r1, mailpit-fips 1.29.6-r0, mailpit-fips 1.29.7-r1, ollama 0.20.3-r1, ollama 0.30.10-r0, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.18.3-r0, ollama-fips 0.21.0-r0, ollama-fips 0.30.11-r1, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-33813 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LM41855 Security fix for CVE-2026-33812 applied in: gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, mailpit 1.29.6-r0, mailpit-fips 1.29.6-r0, ollama 0.20.3-r1, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.18.3-r0, ollama-fips 0.21.0-r0, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-33812 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SN47356 Security fix for CVE-2026-46599 applied in: gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, ollama 0.20.3-r4, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.18.3-r2, ollama-fips 0.21.0-r3, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-46599 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BZ94585 Security fix for CVE-2026-46601 applied in: mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, ollama 0.23.4-r2, ollama 0.30.10-r0, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.30.11-r1, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-46601 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BV44413 Security fix for CVE-2026-46604 applied in: mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.30.11-r1, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-46604 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CA42372 norm

Multiple security vulnerabilities affect the mailpit package. A norm. See references for individual vulnerability details...

GO-2026-6363 Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection in github.com/axllent/mailpit

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection in github.com/axllent/mailpit...

GO-2026-6359 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling in github.com/axllent/mailpit

Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling in github.com/axllent/mailpit...

SUSE CVE-2026-67447

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...

SUSE CVE-2026-67448

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-67446

creationtimestamp| type| source ---|---|--- 2026-09-03 00:35:04+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39 2026-09-03 07:31:59+00:00| seen| https://gist.github.com/alon710/3dcd56ab41cf2fc234bc88855814c85c...

CVE-2026-67445

creationtimestamp| type| source ---|---|--- 2026-09-03 00:35:02+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v 2026-09-03 05:32:21+00:00| seen| https://gist.github.com/alon710/25d950fb1b775a5961200e6e2792284d...

EUVD-2026-63663

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection...

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...

GHSA-W878-PJ84-3J5V Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...