Description

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-20T21:17:07.260Z",
  "pubdate": "2026-08-20T21:17:07.260Z",
  "executiveSummary": "A denial of service vulnerability exists in Mailpit prior to version 1.30.4, specifically within the image thumbnail generation functionality. The flaw arises from improper resource management during the processing of attacker-supplied image attachments, where images are fully decoded into memory before validation of their dimensions, pixel counts, or memory consumption.\nAn unauthenticated attacker who can store a crafted image attachment and reach the web API can exploit this vulnerability to trigger excessive CPU and memory consumption. This resource exhaustion can degrade system availability and potentially lead to service crashes.\nThe vulnerability affects Mailpit versions prior to 1.30.4 and is triggered through the GET /api/v1/message/{id}/part/{partID}/thumb endpoint or automatically when a user opens the message UI via server/ui-src/components/message/MessageAttachments.vue. Successful exploitation requires the ability to store a malicious attachment and access the web application interface over the network.",
  "technicalDetails": "The root cause of the vulnerability resides in the asynchronous or direct decoding of untrusted image data prior to bounds and resource validation. Within the vulnerable component located at server/apiv1/thumbnails.go, the Thumbnail handler retrieves attachment bytes utilizing storage.GetAttachmentPart().\nUpon accepting attachments with an image/* content type, the application invokes imaging.Decode() with AutoOrientation enabled. Crucially, this decoding process occurs before any validation checks are performed on the decoded dimensions, total pixel count, or anticipated memory allocation, and prior to the subsequent execution of imaging.Fill() which scales the image to the intended 180 by 120 pixel dimensions.\nAn attacker can exploit this behavior by constructing a compact, maliciously crafted image file that declares extremely large logical dimensions in its header. When processed by the thumbnail generation routine, the imaging library attempts to allocate a full raster matching the declared massive dimensions, resulting in disproportionately high memory consumption and CPU exhaustion.\nThe attack flow proceeds as follows: First, an unauthenticated client transmits or stores a crafted image attachment containing deceptive dimension headers within Mailpit. Second, the attacker or an unsuspecting user interacts with the message user interface, specifically rendering the message attachments via server/ui-src/components/message/MessageAttachments.vue, which automatically requests the GET /api/v1/message/{id}/part/{partID}/thumb endpoint.\nAlternatively, the attacker can directly issue HTTP GET requests to the vulnerable thumbnail endpoint. Upon receiving the request, the server executes the vulnerable thumbnail handler in server/apiv1/thumbnails.go, reads the attachment, and triggers the unconstrained decode operation.\nThe resulting resource exhaustion impacts the host running Mailpit, causing severe performance degradation, unresponsiveness, or denial of service for legitimate users. Network exposure of the web API and the ability of unauthenticated clients to store messages or attachments are prerequisites for remote exploitation."
}