EUVD-2026-63663
GHSA-w878-pj84-3j5v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable with no auth (PR:N, AV:N, AC:L); availability-only impact (A:L) reflects partial exhaustion typical of single-instance testing tools.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.
AnalysisAI
Uncontrolled memory allocation in Mailpit's SMTP command reader allows unauthenticated remote clients to exhaust server memory by sending oversized pre-DATA command lines. Versions prior to 1.30.4 use Go's unbounded bufio.Reader.ReadString in internal/smtpd/smtpd.go, which allocates the full attacker-controlled input before any syntax rejection or RFC 5321 line-length enforcement occurs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the vulnerable `readLine()` function is invoked before any AUTH exchange, on the raw SMTP command path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly characterizes this as a remote, unauthenticated, low-complexity availability issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Mailpit to version 1.30.4, which is confirmed as the vendor-released fix per the GitHub release tag https://github.com/axllent/mailpit/releases/tag/v1.30.4 and commit 993bed95b3c74d95231af93bd0e0d4c3d5b4db4d. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today