Mailpit CVE-2026-67447

SMTP must be enabled (it is on by default in Mailpit). The attacker must be able to reach the SMTP listener port (default 1025) - no authentication is required (confirmed by CVSS PR:N). The attack requires sending a single SMTP DATA line exceeding the configured MaxMessageSize (default 50 MiB) without an intermediate newline character, so the Go runtime buffers the full line via ReadBytes before the size check fires. No special non-default configuration is needed beyond network reachability to the SMTP port. Exploitation is limited in practice by Mailpit's typical deployment profile: it is designed for local development and CI environments where the SMTP port is bound to localhost or a private LAN, making external attacker reach uncommon. Concurrent connection capability amplifies impact but is not required for a single exploitation event.

The CVSS 3.1 base score of 5.3 (Medium) accurately reflects the constrained impact: network-reachable, no authentication, no complexity, but limited availability impact (A:L) with no confidentiality or integrity consequence. EPSS data was not provided in the input, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. A proof-of-concept is embedded in the GitHub advisory (GHSA-r553-m4fv-5v97), meaning exploit reproduction is trivial for any party reading the advisory. Real-world risk is moderated significantly by deployment context: Mailpit is a developer-oriented testing tool with SMTP typically bound to localhost or a private network - internet-facing exposure is non-default and uncommon. Concurrent oversized connections can amplify memory pressure beyond a single-request impact, but the A:L designation remains appropriate absent evidence of complete OOM-triggered crashes. The risk priority should be elevated for any deployment where the SMTP port (typically 1025) is reachable from untrusted hosts.

An attacker with network access to Mailpit's SMTP port completes a standard SMTP handshake (EHLO, MAIL FROM, RCPT TO, DATA) and then transmits a single DATA payload line of 64 MiB or more without an embedded newline, causing Mailpit to allocate the full oversized buffer before returning the 552 5.3.4 rejection. A proof-of-concept is included in GHSA-r553-m4fv-5v97 demonstrating measurable RSS growth via this technique. An attacker opening multiple concurrent connections with oversized single-line DATA segments can compound memory pressure, potentially impacting the availability of the Mailpit instance.