These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), r [truncated]
Mailpit, an email testing tool and API for developers, is vulnerable to a memory pressure issue due to improper handling of oversized SMTP DATA lines. This allows an unauthenticated SMTP client to cause substantial memory allocation before rejection. The vulnerability arises from the readData() function in Mailpit's internal/smtpd/smtpd.go not properly checking the size of SMTP DATA lines against Server.M [truncated]
Mailpit, an email testing tool and API for developers, is vulnerable to a denial-of-service (DoS) attack due to improper handling of image attachments in versions prior to 1.30.4. The application decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use. This can lead to disproportionately large memory and CPU consumption, degrading avail [truncated]
Mailpit versions prior to 1.30.4 have a vulnerability allowing unauthenticated remote SMTP clients to send oversized command lines, potentially impacting service availability. The issue arises from the way Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() enforces the RFC 5321 512-octet command-line limit. This vulnerabi [truncated]
CVE-2026-45712 is a vulnerability in Mailpit, an email testing tool and API for developers. The vulnerability occurs in the screenshot/print proxy (/proxy?data=…) which maintains a package-level assets map[string]MessageAssets cache. This cache is read without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. This c [truncated]
CVE-2026-45711 is a path traversal vulnerability in Mailpit, an email testing tool and API for developers. The vulnerability exists in the `mailpit dump --http <base-url> <out-dir>` sub-command, which downloads every message from a remote Mailpit instance and writes each one as `<id>.eml` inside the user-supplied output directory. Due to improper handling of the message ID field, an attacker can make Mail [truncated]
Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, 'Server-Side Request Forgery (SSRF) via HTML Check API'), shipped in mailpit `v1.28.3`, hardened `internal/htmlcheck/css.go::downloadCSSToBytes` with a 5MB size cap, a `text/css` content-type check, login-info stripping in `isValidURL`, and an opt-in `--block-remote-css-and-fonts` config flag — but di [truncated]
CVE-2026-55187 is a MEDIUM severity vulnerability in Mailpit's Link Check API. An attacker can bypass internal IP restrictions and map internal service reachability by exploiting incomplete remediation for CVE-2026-27808. The vulnerability allows an attacker to coerce the Link Check API into dialing internal destinations using IPv6 transition mechanisms or prefixes. This issue is fixed in version 1.30.2. [truncated]