CVE-2026-67447 axllent CVE debrief

Who should care

Mailpit users and administrators, SMTP server operators, and security teams responsible for monitoring and protecting email infrastructure should be aware of this vulnerability and take necessary actions to mitigate the risk. They should review Mailpit configurations, update to version 1.30.5 or later, and implement compensating controls to prevent potential memory pressure issues.

Technical summary

The readData() function in Mailpit's internal/smtpd/smtpd.go does not properly check the size of SMTP DATA lines against Server.MaxSize before allocation, allowing an unauthenticated SMTP client to cause substantial memory pressure. This issue can lead to a denial-of-service attack. The vulnerability is fixed in version 1.30.5. Mailpit users should review their configurations and update to the latest version.

Defensive priority

Medium priority due to potential for memory pressure and denial of service.

Recommended defensive actions

• Review and update Mailpit to version 1.30.5 or later
• Implement compensating controls to monitor and limit SMTP client connections
• Verify Mailpit configuration for MaxMessageSize and adjust as necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from Mailpit's source code and CVE description indicates a post-fix gap in handling oversized SMTP DATA lines, allowing substantial memory pressure beyond configured message-size caps. The issue arises from the readData() function in Mailpit's internal/smtpd/smtpd.go not properly checking the size of SMTP DATA lines against Server.MaxSize before allocation. This allows an unauthenticated SMTP client to cause substantial memory pressure. Defenders should verify Mailpit configurations and update to version 1.30.5 or later. They should also monitor for potential memory pressure issues and implement compensating controls.

Official resources