Summary
Ein Angreifer kann mehrere Schwachstellen in MailPit ausnutzen, um einen Denial of Service Angriff durchzuführen.
Product
Mailpit ist ein Open-Source-E-Mail-Testwerkzeug, das als lokaler SMTP-Server zum Auffangen und Anzeigen von E-Mails dient, ohne diese tatsächlich zu versenden.
Vulnerabilities 2
-
Medium 5.3
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command…
-
Medium 5.3
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb…
Revision history
-
#2
CVE-Nummern ergänzt
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-75mr-qw9x-3r39 vom 2026-07-08
https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39
-
GitHub Security Advisory GHSA-w878-pj84-3j5v vom 2026-07-08
https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v