CVE-2026-67445 axllent CVE debrief

Who should care

Developers and administrators using Mailpit versions prior to 1.30.4 should be aware of this vulnerability and take steps to patch or mitigate it. This includes reviewing system configurations, updating Mailpit to version 1.30.4 or later, and monitoring for potential exploitation attempts. Security teams should also review system logs and implement compensating controls to detect and prevent oversized SMTP command lines. Additionally, operators and platform administrators should prioritize patching to prevent potential service availability impacts, and vulnerability management teams should track the status of Mailpit updates and verify the effectiveness of implemented mitigations.

Technical summary

Mailpit versions prior to 1.30.4 have a vulnerability allowing unauthenticated remote SMTP clients to send oversized command lines, potentially impacting service availability. The issue arises from the way Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() enforces the RFC 5321 512-octet command-line limit. This vulnerability is fixed in version 1.30.4, which properly handles command line lengths and prevents potential service disruptions.

Defensive priority

CVE-2026-67445 is rated with a CVSS score of 5.3 and MEDIUM severity. Developers using Mailpit versions prior to 1.30.4 should prioritize patching to prevent potential service availability impacts.

Recommended defensive actions

• Review and apply Mailpit version 1.30.4 or later to address the vulnerability
• Monitor Mailpit installations for potential exploitation attempts
• Implement compensating controls to detect and prevent oversized SMTP command lines
• Review system configurations and update Mailpit to version 1.30.4 or later
• Verify the effectiveness of implemented mitigations and track the status of Mailpit updates
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Mailpit versions prior to 1.30.4. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout. This issue is fixed in version 1.30.4. Evidence limits suggest verifying Mailpit version and update status, checking for potential exploitation attempts, and reviewing system logs for suspicious activity.

Official resources