DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-67445: CVE-2026-67445: Uncontrolled Memory Resource Consumption in Mailpit SMTP and POP3 Services

#security #cve #cybersecurity

CVE-2026-67445: Uncontrolled Memory Resource Consumption in Mailpit SMTP and POP3 Services

Vulnerability ID: CVE-2026-67445
CVSS Score: 5.3
Published: 2026-09-02

An uncontrolled resource consumption vulnerability in Mailpit versions prior to 1.30.4 allows remote, unauthenticated attackers to cause a denial of service (DoS) by sending unbounded command lines to the SMTP and POP3 servers. This memory exhaustion condition bypasses maximum message size limits.

TL;DR

Unauthenticated remote attackers can exhaust system memory and crash Mailpit by streaming long commands without a newline character to the SMTP or POP3 ports.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network
  • CVSS: 5.3
  • EPSS: 0.00371 (30.14th percentile)
  • Impact: Denial of Service (DoS)
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not Listed

Affected Systems

  • Mailpit SMTP Server
  • Mailpit POP3 Server
  • mailpit: < 1.30.4 (Fixed in: 1.30.4)

Code Analysis

Commit: 993bed9

Fix POP3 and SMTP command parser memory exhaustion

Commit: f398107

Merge pull request to fix SMTP/POP3 command parser memory exhaustion

Mitigation Strategies

  • Upgrade the Mailpit package to version 1.30.4 or higher.
  • Restrict SMTP (port 1025) and POP3 (port 1110) traffic to local development networks or loopback interfaces.
  • Configure container memory limits to prevent host system crashes during memory exhaustion events.
  • Implement automatic process restart policies via systemd or Kubernetes to recover from crashes.

Remediation Steps:

  1. Pull the latest Mailpit docker image: docker pull axllent/mailpit:latest
  2. If running local binaries, download v1.30.4 or rebuild using: go install github.com/axllent/mailpit@v1.30.4
  3. Apply firewall configurations restricting access to port 1025 and 1110.
  4. Verify the patch by running the memory consumption proof-of-concept against the updated service.

References

Read the full report for CVE-2026-67445 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)