CVE-2026-67445: Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailpitto a version that resolves this vulnerability.Fixed in 1.30.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Mailpit versions before 1.30.4 are affected where an unauthenticated remote client can connect to the SMTP service. The issue is on the SMTP command path, including authentication continuation lines.
Does limiting message size or DATA input prevent exploitation?
No. MaxMessageSize and DATA limits do not apply because allocation occurs before the DATA phase, while reading an SMTP command or authentication continuation line.
What does an attacker need to do?
An attacker only needs network access to the SMTP service and can send an oversized single command line. No authentication or user interaction is required; concurrent oversized inputs can increase memory pressure and reduce availability.
What should be done if upgrading cannot happen immediately?
Restrict unauthenticated remote access to the Mailpit SMTP service to reduce exposure. The provided data identifies version 1.30.4 as the fix.