Medium 5.3Published Aug 20, 2026

CVE-2026-67445Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Updated under an hour ago (2026-10-19 06:10 UTC)

Does this affect you?

It affects axllent mailpit. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for axllent mailpit

Exploited in the last 30 days

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness (CWE): CWE-400
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Aug 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

axllent mailpit axllent:mailpit (from the name)	before 1.30.4	CNA record

References

https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5vx-refsource-confirm
https://github.com/axllent/mailpit/commit/993bed95b3c74d95231af93bd0e0d4c3d5b4db4dx-refsource-misc
https://github.com/axllent/mailpit/releases/tag/v1.30.4x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.