CVE-2026-23829

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23829", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T15:46:40.841Z", "datePublished": "2026-01-18T23:23:04.176Z", "dateUpdated": "2026-01-20T20:08:41.935Z"}, "containers": {"cna": {"title": "Mailpit has SMTP Header Injection via Regex Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "lang": "en", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-150", "lang": "en", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c"}, {"name": "https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534"}, {"name": "https://github.com/axllent/mailpit/releases/tag/v1.28.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.28.3"}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"version": "< 1.28.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T18:59:54.087Z"}, "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\\r` and `\\n` when used inside a character class. Version 1.28.3 fixes this issue."}], "source": {"advisory": "GHSA-54wq-72mp-cq7c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T20:08:32.596156Z", "id": "CVE-2026-23829", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:08:41.935Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23829", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T20:08:32.596156Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:08:37.547Z"}}], "cna": {"title": "Mailpit has SMTP Header Injection via Regex Bypass", "source": {"advisory": "GHSA-54wq-72mp-cq7c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"status": "affected", "version": "< 1.28.3"}]}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c", "name": "https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534", "name": "https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/axllent/mailpit/releases/tag/v1.28.3", "name": "https://github.com/axllent/mailpit/releases/tag/v1.28.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\\r` and `\\n` when used inside a character class. Version 1.28.3 fixes this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-150", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T18:59:54.087Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23829", "state": "PUBLISHED", "dateUpdated": "2026-01-20T20:08:41.935Z", "dateReserved": "2026-01-16T15:46:40.841Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-18T23:23:04.176Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mailpit", "vendor": "axllent", "versions": [{"status": "affected", "version": "< 1.28.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*", "matchCriteriaId": "D00C1680-049F-472C-A900-66D6B2A11A04", "versionEndExcluding": "1.28.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\\r` and `\\n` when used inside a character class. Version 1.28.3 fixes this issue."}, {"lang": "es", "value": "Mailpit es una herramienta de pruebas de correo electr\u00f3nico y una API para desarrolladores. Antes de la versi\u00f3n 1.28.3, el servidor SMTP de Mailpit era vulnerable a la inyecci\u00f3n de encabezados debido a una expresi\u00f3n regular insuficiente utilizada para validar las direcciones `RCPT TO` y `MAIL FROM`. Un atacante puede inyectar encabezados SMTP arbitrarios (o corromper los existentes) incluyendo caracteres de retorno de carro (\"\\r\") en la direcci\u00f3n de correo electr\u00f3nico. Esta inyecci\u00f3n de encabezados se produce porque la expresi\u00f3n regular destinada a filtrar los caracteres de control no excluye \"\\r\" y \"\\n\" cuando se utiliza dentro de una clase de caracteres. La versi\u00f3n 1.28.3 corrige este problema."}], "id": "CVE-2026-23829", "lastModified": "2026-06-17T10:22:10.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23829", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T20:08:32.596156Z", "version": "2.0.3"}}]}, "published": "2026-01-19T00:15:48.707", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.28.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:05:49.591791+00:00", "value": {"mitigation_remediation": ["Upgrade Mailpit to version 1.28.3 or later.", "Apply a corrected regular expression that rejects carriage return and line feed characters in RCPT TO and MAIL FROM addresses (CWE\u201193).", "Enforce strict access control on SMTP commands to prevent unauthorized header injection (CWE\u2011150).", "Restrict the SMTP interface to trusted IP addresses or internal networks until the upgrade is completed."], "summary": {"action": "Immediate Patch", "impact": "SMTP Header Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the axllent Mailpit email testing tool. All releases prior to version 1.28.3 are impacted, as the buggy regular expression is present in those builds. Version 1.28.3 and later incorporate a corrected regex that properly excludes forbidden control characters.", "description_and_impact": "Mailpit\u2019s SMTP server accepted email addresses that contain carriage return characters because the validation regular expression omitted \\r and \\n when filtering control characters. This flaw lets an attacker embed CRLF sequences in the RCPT TO or MAIL FROM addresses, which causes the SMTP engine to interpret the injected characters as header delimiters. The result is that an attacker can add arbitrary SMTP headers or corrupt existing ones, potentially forging authentication headers, redirecting email flows, or enabling spam and phishing campaigns. An attacker can exploit this by connecting to the SMTP interface, authenticating if required, and sending a crafted RCPT TO or MAIL FROM command containing CRLF characters.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. Mailpit exposes an SMTP interface to network clients, so the attack vector is remote via the SMTP protocol, inferred from the fact that the product is an SMTP server; this is not directly stated but can be deduced from the product description. The vulnerability is not currently listed in CISA\u2019s KEV catalog, implying no known active exploitation at this time. Systems that remain unpatched could be used to subvert email delivery by injecting malicious headers."}}}}, "created": "2026-01-19T09:19:06.164211+00:00", "updated": "2026-04-18T19:15:10.606228+00:00", "vendors": ["axllent", "axllent$PRODUCT$mailpit"]}