CVE-2026-67447

Katalog CVE

CVSS 5.3 · Medium EPSS 0,51%

Kerentanan Allocation of Resources Without Limits or Throttling. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.

Rincian

Terbit di NVD

20 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c
• https://github.com/axllent/mailpit/releases/tag/v1.30.5
• https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97