Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-67447— Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

Quick assessment

Affected
axllent mailpit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mailpit 是一款面向开发者的电子邮件测试工具及 API。在版本 1.30.0 至 1.30.5 中，Mailpit 的内部组件 中的 函数在针对完成的 SMTP DATA 行与 （服务器最大消息大小）进行 大小检查之前，调用了 。这使得未认证的 SMTP 客户端能够发送单条长度超过配置的最大消息大小（MaxMessageSize）的数据行，从而导致 Mailpit 在返回 552 5.3.4 拒绝响应之前，提前分配了整个数据行所需的内存。尽管多行 DATA 累积部分已受到限制，但该修复后的代码间隙仍然存在；并

CVSS 5.3 · Medium EPSS 0.37% · P30

Affected Version Matrix 1

VendorProduct Version RangeStatus
axllent mailpit >= 1.30.0, < 1.30.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-67447

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
Source: CVE Program / CVE List V5
Vulnerability Description
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
axllent mailpit >= 1.30.0, < 1.30.5 -

II. Public POCs for CVE-2026-67447

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-67447

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-67447 (1)

Vendor Advisories for CVE-2026-67447 (1)

Vendor Pages for CVE-2026-67447 (1)

Same Patch Batch · axllent · 2026-08-20 · 4 CVEs total

CVE-2026-67448 6.5 MEDIUM Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22
CVE-2026-67445 5.3 MEDIUM Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
CVE-2026-67446 5.3 MEDIUM Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

IV. Related Vulnerabilities

Same product: mailpit
Same vendor: axllent
Same weakness: CWE-770

V. Comments for CVE-2026-67447

No comments yet

Leave a comment