CVE-2026-67446: CVE-2026-67446: Unbounded Image Dimension Decoding in Mailpit Thumbnail Generation

#security #cve #cybersecurity

CVE-2026-67446: Unbounded Image Dimension Decoding in Mailpit Thumbnail Generation

Vulnerability ID: CVE-2026-67446
CVSS Score: 5.3
Published: 2026-09-02

Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. This allows remote, unauthenticated attackers to trigger unconstrained memory allocation and cause a Denial of Service (DoS) via resource exhaustion.

TL;DR

Unauthenticated remote attackers can crash Mailpit servers by transmitting email attachments containing compressed images with extremely large logical dimensions, triggering out-of-memory errors during thumbnail generation.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-400, CWE-770
Attack Vector: Network (AV:N)
CVSS Score: 5.3 (Medium)
Exploit Status: Proof of Concept
Impact: Denial of Service (DoS)
KEV Status: Not Listed

Affected Systems

Mailpit
Mailpit: < v1.30.4 (Fixed in: v1.30.4)

Code Analysis

Commit: 6bcb633

Implement image dimension limit for thumbnail generation to prevent OOM decompression bomb vulnerability

Exploit Details

Research Context: Conceptual proof of concept showing minimal PNG pixel bomb generation

Mitigation Strategies

Restrict access to the SMTP and HTTP interfaces of Mailpit to local or authorized developers.
Enforce local binding (127.0.0.1) for testing environments to prevent remote network access.

Remediation Steps:

Upgrade Mailpit to version v1.30.4 or higher.
Configure automated container restart policies for recovery in case of resource exhaustion.

References

Read the full report for CVE-2026-67446 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community