Description

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-20T21:17:07.110Z",
  "pubdate": "2026-08-20T21:17:07.110Z",
  "executiveSummary": "Mailpit prior to version 1.30.4 is susceptible to a denial of service vulnerability caused by improper handling of incoming SMTP command lines.\nThe vulnerability allows an unauthenticated remote SMTP client to exhaust server memory resources by transmitting an oversized single command line.\nBecause the input buffering occurs via session.readLine() utilizing bufio.Reader.ReadString prior to enforcing the RFC 5321 512-octet command-line limit or performing session.parseLine() validation, the application fully allocates the unbounded string in memory before syntax rejection or connection timeout.\nStandard constraints such as MaxMessageSize and DATA limits are entirely bypassed since this condition occurs along the pre-DATA execution path.\nAdditionally, the same underlying command reader logic is shared by authentication handlers including handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, enabling concurrent oversized inputs to compound memory pressure.\nSuccessful exploitation severely reduces service availability, potentially crashing the mail testing tool through out-of-memory termination.",
  "technicalDetails": "The vulnerability resides within the SMTP daemon component of Mailpit, specifically implemented in internal/smtpd/smtpd.go.\nDuring the session lifecycle, incoming SMTP commands are read via the session.readLine() method utilizing bufio.Reader.ReadString.\nThe root cause is the reading and memory allocation of command lines prior to enforcing the RFC 5321 512-octet command-line length restriction and before executing session.parseLine() to analyze the SMTP verb.\nBecause memory allocation happens unconditionally upon receiving the delimiter without an intermediary length check or bounded buffer reader, an unauthenticated remote attacker connected via the network can supply an arbitrarily large string as a single command line.\nThe attack flow proceeds as follows: 1. The remote attacker establishes a TCP connection to the Mailpit SMTP service. 2. The attacker transmits an extremely large sequence of bytes without a newline delimiter or structured as a massive single-line command. 3. The vulnerable bufio.Reader.ReadString function reads and accumulates the continuous stream into a dynamic string allocation within memory. 4. Because pre-DATA path limits and standard MaxMessageSize restrictions do not apply here, the server continues allocating memory to hold the entire payload. 5. The attack vector can be amplified concurrently across authentication routines including handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() during the processing of continuation lines. 6. The accumulation of massive string allocations exhausts available system memory, leading to service degradation, unresponsiveness, or application crash due to memory exhaustion.\nAuthentication requirements: None, as the flaw is exploitable by unauthenticated remote SMTP clients.\nPrivilege requirements: None.\nNetwork exposure: Accessible over the network wherever the SMTP listener is exposed.\nAffected versions: Mailpit prior to version 1.30.4."
}