CVE-2026-67446

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67446", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-29T15:07:24.992Z", "datePublished": "2026-08-20T21:10:28.074Z", "dateUpdated": "2026-08-21T14:56:09.415Z"}, "containers": {"cna": {"title": "Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39"}, {"name": "https://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35"}, {"name": "https://github.com/axllent/mailpit/releases/tag/v1.30.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.4"}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"version": "< 1.30.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:10:28.074Z"}, "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4."}], "source": {"advisory": "GHSA-75mr-qw9x-3r39", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T14:56:02.744495Z", "id": "CVE-2026-67446", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T14:56:09.415Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67446", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T14:56:02.744495Z"}}}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T14:55:41.601Z"}}], "cna": {"title": "Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling", "source": {"advisory": "GHSA-75mr-qw9x-3r39", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"status": "affected", "version": "< 1.30.4"}]}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "name": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35", "name": "https://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/axllent/mailpit/releases/tag/v1.30.4", "name": "https://github.com/axllent/mailpit/releases/tag/v1.30.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:10:28.074Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67446", "state": "PUBLISHED", "dateUpdated": "2026-08-21T14:56:09.415Z", "dateReserved": "2026-07-29T15:07:24.992Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T21:10:28.074Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mailpit", "vendor": "axllent", "versions": [{"status": "affected", "version": "< 1.30.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4."}, {"lang": "es", "value": "Mailpit es una herramienta de prueba de correo electr\u00f3nico y una API para desarrolladores. Antes de la versi\u00f3n 1.30.4, Mailpit decodifica los archivos adjuntos de imagen suministrados por el atacante en un r\u00e1ster completo antes de verificar las dimensiones decodificadas, el recuento de p\u00edxeles o el uso de memoria en el endpoint GET /api/v1/message/{id}/part/{partID}/thumb. El gestor de miniaturas en server/apiv1/thumbnails.go obtiene los bytes del archivo adjunto a trav\u00e9s de storage.GetAttachmentPart(), acepta contenido image/* y llama a imaging.Decode() con AutoOrientation antes de que imaging.Fill() escale la imagen a 180 por 120 p\u00edxeles. Una imagen compacta que declara dimensiones muy grandes puede, por lo tanto, consumir una cantidad desproporcionadamente grande de memoria y CPU, y abrir la interfaz de usuario del mensaje puede activar el mismo endpoint a trav\u00e9s de server/ui-src/components/message/MessageAttachments.vue. Esto puede degradar la disponibilidad cuando un cliente no autenticado puede almacenar el archivo adjunto manipulado y alcanzar la API web. Este problema est\u00e1 solucionado en la versi\u00f3n 1.30.4."}], "id": "CVE-2026-67446", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67446", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T14:56:02.744495Z", "version": "2.0.3"}}]}, "published": "2026-08-20T21:17:07.260", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35"}, {"source": "security-advisories@github.com", "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.30.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mailpit", "source": "cna", "vendor": "axllent"}, "product": "mailpit", "vendor": "axllent"}], "created": "2026-08-20T23:30:06.970635+00:00", "updated": "2026-08-21T01:15:07.277725+00:00", "vendors": ["axllent", "axllent$PRODUCT$mailpit"]}