CVE-2026-67446 axllent CVE debrief

Who should care

Mailpit users and administrators, security teams, and developers using Mailpit for email testing should be aware of this vulnerability and take necessary actions to protect their deployments. Security teams should prioritize this issue due to the potential for DoS attacks.

Technical summary

The Thumbnail handler in Mailpit's server/apiv1/thumbnails.go decodes image attachments without properly checking dimensions, leading to potential DoS attacks. This issue is fixed in version 1.30.4. The vulnerability is triggered when an unauthenticated client can store the crafted attachment and reach the web API, degrading availability. Security teams should prioritize this issue due to the potential for DoS attacks and implement compensating controls such as rate limiting and IP blocking.

Defensive priority

Medium priority due to potential for DoS attacks

Recommended defensive actions

• Inventory checks for Mailpit installations and versions prior to 1.30.4
• Apply vendor remediation (upgrade to version 1.30.4 or later)
• Implement compensating controls (e.g., rate limiting, IP blocking)
• Monitor for suspicious activity and exception tracking
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence is limited; primary official records indicate a potential DoS vulnerability in Mailpit versions prior to 1.30.4. Defensive verification tasks are recommended. The CVE record was published on 2026-08-20T21:17:07.260Z and has not been modified since then. Mailpit users should verify their deployments and apply the vendor remediation. Security teams should monitor for suspicious activity and exception tracking.

Official resources