EUVD-2026-63659
GHSA-75mr-qw9x-3r39
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-accessible unauthenticated SMTP and API with no scope change; only availability is impacted via uncontrolled memory allocation.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4.
AnalysisAI
Uncontrolled resource consumption in Mailpit's thumbnail generation endpoint allows unauthenticated network clients to exhaust server memory and CPU by submitting email attachments containing image decompression bombs. The affected code path in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation before performing any dimension, pixel-count, or memory validation, meaning a compact on-disk image declaring enormous pixel dimensions triggers full raster allocation prior to the 180×120 scaling step. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions: first, the attacker must be able to deliver email to the Mailpit SMTP intake (unauthenticated SMTP on port 1025 is Mailpit's default developer configuration); second, either the attacker must be able to call the thumbnail API endpoint directly (knowing the message ID and part ID, which are enumerable after delivery), or a legitimate user must open the crafted email in the Mailpit web UI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (score 5.3) correctly characterizes the attack as low-complexity and unauthenticated but rates availability impact as Limited, which may understate practical DoS potential from repeated submissions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Mailpit to version 1.30.4 or later; this is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today