CVE-2026-23829

Katalog CVE

CVSS 5.3 · Medium EPSS 1,4%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada axllent mailpit. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.

Rincian

Terbit di NVD

19 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534 patch
• https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c exploit · mitigasi · advisory pihak ketiga
• https://github.com/axllent/mailpit/releases/tag/v1.28.3 product · release notes