CVE-2026-45712

Katalog CVE

CVSS 5.9 · Medium EPSS 0,34%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada axllent mailpit. Skor CVSS 3.1 5.9 (Medium) menurut github.com.

Deskripsi (NVD)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go's runtime raises fatal error: concurrent map read and map write — a runtime.throw that is not recoverable by http.Server's handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it. Version 1.30.0 contains a patch.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

28 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722 exploit · advisory vendor
• https://github.com/axllent/mailpit/releases/tag/v1.30.0 release notes