CVE-2026-67447: CVE-2026-67447: Unbounded Memory Allocation leading to Denial of Service in Mailpit SMTP Server

#security #cve #cybersecurity

CVE-2026-67447: Unbounded Memory Allocation leading to Denial of Service in Mailpit SMTP Server

Vulnerability ID: CVE-2026-67447
CVSS Score: 5.3
Published: 2026-08-20

An uncontrolled resource allocation vulnerability (CWE-770) affects Mailpit SMTP server versions 1.30.0 through 1.30.4. The vulnerability is located within the DATA parsing logic, where an unauthenticated remote attacker can stream an endless sequence of bytes devoid of newline characters. Because line size limits are evaluated only after buffer completion, the Go runtime repeatedly allocates memory on the heap to store the single oversized line, causing resource exhaustion and an Out-Of-Memory termination of the service process.

TL;DR

Unauthenticated remote attackers can crash the Mailpit SMTP server via memory exhaustion by sending an endless stream of characters without newline delimiters during the DATA command.

Technical Details

CWE ID: CWE-770
Attack Vector: Network
CVSS v3.1 Score: 5.3 (Medium)
Exploit Maturity: None / Theoretical Proof-of-Concept
CISA KEV: Not Listed
Ransomware Use: No
Vulnerability Class: Uncontrolled Resource Allocation (CWE-770)

Affected Systems

Mailpit SMTP server daemon
Mailpit: >= 1.30.0, < 1.30.5 (Fixed in: 1.30.5)

Code Analysis

Commit: 8720c6b

Enforce MaxSize early when reading SMTP lines in smtpd to mitigate OOM DoS

@@ -887,13 +902,10 @@ func (s *session) readData() ([]byte, error) {...

Mitigation Strategies

Upgrade Mailpit to v1.30.5 or newer
Bind SMTP services to localhost or restrict exposure
Enforce MaxMessageSize configuration limits

Remediation Steps:

Download and deploy Mailpit v1.30.5 from official releases.
Review network layout to verify SMTP (port 1025) and Web UI (port 8025) are not exposed to untrusted networks.
Verify SMTP message limits are configured appropriately inside Mailpit settings.

References

Read the full report for CVE-2026-67447 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community