EUVD-2026-63664
GHSA-r553-m4fv-5v97
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SMTP port is network-accessible with no authentication; memory pressure impact is limited (A:L), not a confirmed crash, with zero confidentiality or integrity consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.
AnalysisAI
Memory exhaustion in Mailpit's SMTP server (versions 1.30.0 through 1.30.4) allows unauthenticated remote SMTP clients to force heap allocation beyond the configured MaxMessageSize limit by transmitting a single DATA line exceeding the cap - because bufio.Reader.ReadBytes('\n') buffers the entire line into memory before the size check is applied. This is a post-fix incomplete remediation of an earlier SMTP body-size advisory: multi-line DATA accumulation was bounded, but single-line pre-read was not, leaving a residual gap in versions 1.30.0-1.30.4. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | SMTP must be enabled (it is on by default in Mailpit). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 (Medium) accurately reflects the constrained impact: network-reachable, no authentication, no complexity, but limited availability impact (A:L) with no confidentiality or integrity consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to Mailpit's SMTP port completes a standard SMTP handshake (EHLO, MAIL FROM, RCPT TO, DATA) and then transmits a single DATA payload line of 64 MiB or more without an embedded newline, causing Mailpit to allocate the full oversized buffer before returning the 552 5.3.4 rejection. A proof-of-concept is included in GHSA-r553-m4fv-5v97 demonstrating measurable RSS growth via this technique. … |
| Remediation | Upgrade to Mailpit v1.30.5, which is confirmed by the official GitHub release tag at https://github.com/axllent/mailpit/releases/tag/v1.30.5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Mailpit versions up to 1.28.2 contains a vulnerability that allows attackers to intercept sensitive data such as email c
Mailpit versions 1.28.0 and earlier contain a server-side request forgery vulnerability in the /proxy endpoint that perm
Mailpit versions prior to 1.29.2 contain a Server-Side Request Forgery vulnerability in the Link Check API that allows u
Mailpit versions before 1.28.3 contain a server-side request forgery vulnerability in the HTML Check feature that allows
Header injection in Mailpit's SMTP server prior to version 1.28.3 allows unauthenticated remote attackers to inject or m
Cross-site WebSocket hijacking in Mailpit 1.29.0-1.30.5 exposes live email metadata to any website the developer visits,
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today