PatchSiren cyber security CVE debrief
CVE-2026-45712 axllent CVE debrief
CVE-2026-45712 is a vulnerability in Mailpit, an email testing tool and API for developers. The vulnerability occurs in the screenshot/print proxy (/proxy?data=…) which maintains a package-level assets map[string]MessageAssets cache. This cache is read without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. This can cause a fatal error due to concurrent map read and map write, leading to the termination of the Mailpit process, including its SMTP, POP3, and HTTP listeners.
- Vendor
- axllent
- Product
- mailpit
- CVSS
- MEDIUM 5.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-21
Who should care
Developers and administrators using Mailpit for email testing and API functionality should be aware of this vulnerability and take steps to mitigate it. This vulnerability has a CVSS score of 5.9 and a severity of MEDIUM.
Technical summary
The vulnerability in Mailpit occurs due to the lack of synchronization when reading from a package-level cache (assets map[string]MessageAssets) in the screenshot/print proxy (/proxy?data=…). This cache is accessed concurrently by a long-running cleanup goroutine and CSS-rewriting code paths that write to it under a lock. When an unsynchronized read happens at the same time as a synchronized write, Go's runtime throws a fatal error: concurrent map read and map write. This error is not recoverable by http.Server's handler-panic recover, causing the entire Mailpit process to exit. The process includes SMTP, POP3, and HTTP listeners, which will all be taken down.
Defensive priority
Medium priority should be given to patching this vulnerability due to its MEDIUM severity and potential impact on Mailpit services.
Recommended defensive actions
- Apply the patch by updating Mailpit to version 1.30.0 or later.
- Review and adjust concurrent access to shared resources in Mailpit's codebase.
- Implement compensating controls such as monitoring for service restarts or errors indicative of this issue.
- Inventory Mailpit installations and verify their version.
- Consider temporarily disabling affected components if immediate patching is not feasible.
Evidence notes
The CVE record was published on 2026-07-20T16:17:00.470Z and was last modified on 2026-07-21T20:25:45.920Z. The NVD entry for this CVE is currently awaiting analysis. References include GitHub release notes and security advisories related to Mailpit version 1.30.0.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T16:17:00.470Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.