PatchSiren

axllent CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM axllent CVE published 2026-08-20

CVE-2026-67448

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), r [truncated]

MEDIUM axllent CVE published 2026-08-20

CVE-2026-67447

Mailpit, an email testing tool and API for developers, is vulnerable to a memory pressure issue due to improper handling of oversized SMTP DATA lines. This allows an unauthenticated SMTP client to cause substantial memory allocation before rejection. The vulnerability arises from the readData() function in Mailpit's internal/smtpd/smtpd.go not properly checking the size of SMTP DATA lines against Server.M [truncated]

MEDIUM axllent CVE published 2026-08-20

CVE-2026-67446

Mailpit, an email testing tool and API for developers, is vulnerable to a denial-of-service (DoS) attack due to improper handling of image attachments in versions prior to 1.30.4. The application decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use. This can lead to disproportionately large memory and CPU consumption, degrading avail [truncated]

MEDIUM axllent CVE published 2026-08-20

CVE-2026-67445

Mailpit versions prior to 1.30.4 have a vulnerability allowing unauthenticated remote SMTP clients to send oversized command lines, potentially impacting service availability. The issue arises from the way Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() enforces the RFC 5321 512-octet command-line limit. This vulnerabi [truncated]

MEDIUM axllent CVE published 2026-07-20

CVE-2026-45712

CVE-2026-45712 is a vulnerability in Mailpit, an email testing tool and API for developers. The vulnerability occurs in the screenshot/print proxy (/proxy?data=…) which maintains a package-level assets map[string]MessageAssets cache. This cache is read without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. This c [truncated]

MEDIUM axllent CVE published 2026-07-20

CVE-2026-45711

CVE-2026-45711 is a path traversal vulnerability in Mailpit, an email testing tool and API for developers. The vulnerability exists in the `mailpit dump --http <base-url> <out-dir>` sub-command, which downloads every message from a remote Mailpit instance and writes each one as `<id>.eml` inside the user-supplied output directory. Due to improper handling of the message ID field, an attacker can make Mail [truncated]

MEDIUM axllent CVE published 2026-07-20

CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, 'Server-Side Request Forgery (SSRF) via HTML Check API'), shipped in mailpit `v1.28.3`, hardened `internal/htmlcheck/css.go::downloadCSSToBytes` with a 5MB size cap, a `text/css` content-type check, login-info stripping in `isValidURL`, and an opt-in `--block-remote-css-and-fonts` config flag — but di [truncated]

MEDIUM axllent CVE published 2026-07-10

CVE-2026-55187

CVE-2026-55187 is a MEDIUM severity vulnerability in Mailpit's Link Check API. An attacker can bypass internal IP restrictions and map internal service reachability by exploiting incomplete remediation for CVE-2026-27808. The vulnerability allows an attacker to coerce the Link Check API into dialing internal destinations using IPv6 transition mechanisms or prefixes. This issue is fixed in version 1.30.2. [truncated]