PT-2026-41968 · Mailpit · Mailpit
CVE-2026-45713
·
Published
2026-05-19
·
Updated
2026-07-30
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Mailpit versions prior to 1.30.0
Description
Unauthenticated remote attackers can cause a denial of service (DoS) by sending arbitrarily large messages via the SMTP server or the HTTP API. The SMTP server fails to assign a value to the
Server.MaxSize field, which controls the maximum allowed DATA payload size, leaving it at a default of zero (no limit). Similarly, the HTTP '/api/v1/send' endpoint decodes the request body without using a limit like http.MaxBytesReader.Because the default listeners bind to [::]:1025 (SMTP) and [::]:8025 (HTTP) without requiring authentication, an attacker can trigger a RAM consumption spike with a 7-10x amplification factor as the raw frame is processed into an envelope tree, search-text index, and zstd-encoded SQLite write. This can lead to out-of-memory (OOM) kills and a full process crash. Additionally, oversized messages are persisted to the SQLite store, which can lead to significant disk space exhaustion.
Recommendations
Update to version 1.30.0.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mailpit