CVE-2026-67446

Mailpit , an email testing tool and API for developers, is vulnerable to a memory exhaustion issue in its thumbnail generation endpoint (GET /api/v1/message/{id}/part/{partID}/thumb). The handler in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation on attacker-supplied image ...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

EUVD-2026-63659

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

PT-2026-79137

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine using bufio.Reader.ReadString before session.parseLine parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticate...

PT-2026-79138

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

PT-2026-79204

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...

PT-2026-79205

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, rclone, ollama-fips, gitea-fips, seaweedfs, seaweedfs-rocksdb-fips, fortio-fips, seaweedfs-rocksdb, gitea, kitty, ollama, mattermost-fips, kubescape, nemo, seaweedfs-fips, bento, seaweedfs-operator, kubescape-server, rclone-fips, mailpit,...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: gitea, kubescape, ollama, mattermost, rclone, kitty, seaweedfs, mailpit, bento, pdfcpu...

CVE-2026-46603 vulnerabilities

Vulnerabilities for packages: gitea, kubescape, ollama, mattermost, rclone, kitty, seaweedfs, mailpit, bento, pdfcpu...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, rclone-fips, hugo-fips, seaweedfs, mailpit, hugo-extended, mailpit-fips, mattermost, mattermost-fips, ollama, rclone, seaweedfs-fips, ollama-fips, listmonk, seaweedfs-operator, hugo...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, rclone-fips, gitlab-workhorse-ce, hugo-fips, mailpit, hugo-extended, mailpit-fips, mattermost, filebrowser, mattermost-fips, rclone, seaweedfs, seaweedfs-fips, seaweedfs-rocksdb-fips, listmonk, seaweedfs-operator, hugo, seaweedfs-rocksdb...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: ollama, hugo-extended, mattermost, hugo, seaweedfs, mailpit, rclone...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: filebrowser, hugo-extended, mattermost, hugo, seaweedfs, mailpit, rclone...

GO-2026-5061 vulnerabilities

Vulnerabilities for packages: gitea, ollama, mailpit, mattermost, rclone, seaweedfs, kubescape, bento, pdfcpu...

CLEANSTART-2026-JR76214 Security fixes in mailpit 1.30.3-r1

Package mailpit version 1.30.3-r1 fixes 1 vulnerabilities: CVE-2026-56852...

SUSE CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit v1.28.3, hardened internal/htmlcheck/css.go::downloadCSSToBytes with a 5MB size cap, a text/css content-type check,...

SUSE CVE-2026-45711

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http sub-command downloads every message from a remote Mailpit instance and writes each one as .eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON...

SUSE CVE-2026-45712

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy /proxy?data=... maintains a package-level assets mapstringMessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and re-entrant...