CVE-2026-67445 axllent CVE debrief

Who should care

Defenders responsible for Mailpit installations, especially those exposed to untrusted SMTP clients, should assess their exposure and prioritize upgrading to version 1.30.4 if vulnerable.

Why it matters

CVE-2026-67445 is a vulnerability in Mailpit that allows an unauthenticated remote SMTP client to send an oversized single command line, potentially causing memory pressure and reducing service availability. Defenders responsible for Mailpit installations should assess their exposure and prioritize upgrading to version 1.30.4 if vulnerable.

• Potential memory pressure and reduced service availability due to oversized SMTP command lines
• Verification of Mailpit installations for exposure to untrusted SMTP clients
• Upgrade to version 1.30.4 to fix the vulnerability

Technical summary

The vulnerability in Mailpit allows an unauthenticated remote SMTP client to send an oversized single command line, potentially causing memory pressure and reducing service availability. This issue is fixed in version 1.30.4. The vulnerability can cause memory pressure and reduce service availability due to oversized SMTP command lines. Defenders should prioritize verifying exposure of Mailpit installations to untrusted SMTP clients and upgrading to version 1.30.4 if vulnerable. The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version.

Defensive priority

Defenders should prioritize verifying exposure of Mailpit installations to untrusted SMTP clients and upgrading to version 1.30.4 if vulnerable.

Recommended defensive actions

• Verify Mailpit installations for exposure to untrusted SMTP clients
• Upgrade to Mailpit version 1.30.4 if vulnerable
• Monitor for oversized SMTP command lines
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.