PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45712 axllent CVE debrief

CVE-2026-45712 is a vulnerability in Mailpit, an email testing tool and API for developers. The vulnerability occurs in the screenshot/print proxy (/proxy?data=…) which maintains a package-level assets map[string]MessageAssets cache. This cache is read without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. This can cause a fatal error due to concurrent map read and map write, leading to the termination of the Mailpit process, including its SMTP, POP3, and HTTP listeners.

Vendor
axllent
Product
mailpit
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-28
Advisory published
2026-07-20
Advisory updated
2026-07-28

Who should care

Developers and administrators using Mailpit for email testing and API functionality should be aware of this vulnerability and take steps to mitigate it. This vulnerability has a CVSS score of 5.9 and a severity of MEDIUM.

Technical summary

The vulnerability in Mailpit occurs due to the lack of synchronization when reading from a package-level cache (assets map[string]MessageAssets) in the screenshot/print proxy (/proxy?data=…). This cache is accessed concurrently by a long-running cleanup goroutine and CSS-rewriting code paths that write to it under a lock. When an unsynchronized read happens at the same time as a synchronized write, Go's runtime throws a fatal error: concurrent map read and map write. This error is not recoverable by http.Server's handler-panic recover, causing the entire Mailpit process to exit. The process includes SMTP, POP3, and HTTP listeners, which will all be taken down.

Defensive priority

Medium priority should be given to patching this vulnerability due to its MEDIUM severity and potential impact on Mailpit services.

Recommended defensive actions

  • Apply the patch by updating Mailpit to version 1.30.0 or later.
  • Review and adjust concurrent access to shared resources in Mailpit's codebase.
  • Implement compensating controls such as monitoring for service restarts or errors indicative of this issue.
  • Inventory Mailpit installations and verify their version.
  • Consider temporarily disabling affected components if immediate patching is not feasible.

Evidence notes

The CVE record was published on 2026-07-20T16:17:00.470Z and was last modified on 2026-07-21T20:25:45.920Z. The NVD entry for this CVE is currently awaiting analysis. References include GitHub release notes and security advisories related to Mailpit version 1.30.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45712 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45712

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45712 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45712

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.