CVE-2026-67447 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
Unauthenticated attackers can cause memory exhaustion in Mailpit by sending oversized SMTP DATA lines before size limits are enforced.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67447?
CVE-2026-67447 is a medium-severity denial of service vulnerability in axllent mailpit, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.
Weakness: CWE-770
Which versions are affected by CVE-2026-67447?
3 open source packages ship an affected version, including github.com/axllent/mailpit.
| Package | Affected | Fixed in |
|---|---|---|
github.com/axllent/mailpit Go | From 1.30.0 | 1.30.5 |
github.com/axllent/mailpit Go | From 1.30.0 | 1.30.5 |
github.com/axllent/mailpit Go | From 1.30.0 | 1.30.5 |
How do I fix CVE-2026-67447?
Upgrade github.com/axllent/mailpit to 1.30.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-67447 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67447 exists.
Sources
Also known as GHSA-r553-m4fv-5v97, GO-2026-6272.