CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

PT-2026-55207

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.30.1 Description An incomplete fix for a previous denial-of-service issue left several API endpoints without body-size limits. An unauthenticated remote attacker can send a specially crafted JSON request containing ...