CVE-2026-45712

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45712", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T05:51:48.665Z", "datePublished": "2026-07-20T14:59:40.516Z", "dateUpdated": "2026-07-20T15:33:02.751Z"}, "containers": {"cna": {"title": "Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722"}, {"name": "https://github.com/axllent/mailpit/releases/tag/v1.30.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0"}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"version": "< 1.30.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T14:59:40.516Z"}, "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=\u2026) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go's runtime raises fatal error: concurrent map read and map write \u2014 a runtime.throw that is not recoverable by http.Server's handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it. Version 1.30.0 contains a patch."}], "source": {"advisory": "GHSA-w4vj-r5pg-3722", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T15:32:57.656933Z", "id": "CVE-2026-45712", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T15:33:02.751Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45712", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T15:32:57.656933Z"}}}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T15:32:47.553Z"}}], "cna": {"title": "Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)", "source": {"advisory": "GHSA-w4vj-r5pg-3722", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"status": "affected", "version": "< 1.30.0"}]}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722", "name": "https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0", "name": "https://github.com/axllent/mailpit/releases/tag/v1.30.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=\u2026) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go's runtime raises fatal error: concurrent map read and map write \u2014 a runtime.throw that is not recoverable by http.Server's handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it. Version 1.30.0 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T14:59:40.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45712", "state": "PUBLISHED", "dateUpdated": "2026-07-20T15:33:02.751Z", "dateReserved": "2026-05-13T05:51:48.665Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T14:59:40.516Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mailpit", "vendor": "axllent", "versions": [{"status": "affected", "version": "< 1.30.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*", "matchCriteriaId": "3ECED29B-387E-4170-B0E7-1818C63ADB60", "versionEndExcluding": "1.30.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=\u2026) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go's runtime raises fatal error: concurrent map read and map write \u2014 a runtime.throw that is not recoverable by http.Server's handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it. Version 1.30.0 contains a patch."}, {"lang": "es", "value": "Mailpit es una herramienta de prueba de correo electr\u00f3nico y API para desarrolladores. Antes de la versi\u00f3n 1.30.0, el proxy de captura de pantalla/impresi\u00f3n (/proxy?data=...) mantiene una cach\u00e9 de activos a nivel de paquete map[string]MessageAssets, pero lee el mapa sin mantener assetsMutex mientras una goroutine de limpieza de larga duraci\u00f3n y una ruta de c\u00f3digo de reescritura de CSS (reentrante) escriben concurrentemente en \u00e9l bajo el bloqueo. Cuando la lectura no sincronizada coincide con una escritura sincronizada, el tiempo de ejecuci\u00f3n de Go genera un error fatal: lectura concurrente de mapa y escritura de mapa - un runtime.throw que no es recuperable por el recuperador de p\u00e1nico del gestor del servidor HTTP. Todo el proceso de Mailpit se cierra, llevando consigo los oyentes SMTP, POP3 y HTTP. La versi\u00f3n 1.30.0 contiene un parche."}], "id": "CVE-2026-45712", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45712", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T15:32:57.656933Z", "version": "2.0.3"}}]}, "published": "2026-07-20T16:17:00.470", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.30.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mailpit", "source": "cna", "vendor": "axllent"}, "product": "mailpit", "vendor": "axllent"}], "created": "2026-07-20T23:45:04.952003+00:00", "updated": "2026-07-30T19:30:09.696245+00:00", "vendors": ["axllent", "axllent$PRODUCT$mailpit"]}