CVE-2026-67447

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67447", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-29T15:07:24.992Z", "datePublished": "2026-08-20T21:15:06.567Z", "dateUpdated": "2026-08-21T16:19:21.564Z"}, "containers": {"cna": {"title": "Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97"}, {"name": "https://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c"}, {"name": "https://github.com/axllent/mailpit/releases/tag/v1.30.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.5"}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"version": ">= 1.30.0, < 1.30.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:15:06.567Z"}, "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5."}], "source": {"advisory": "GHSA-r553-m4fv-5v97", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T16:18:52.447416Z", "id": "CVE-2026-67447", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T16:19:21.564Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67447", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T16:18:52.447416Z"}}}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T16:19:16.712Z"}}], "cna": {"title": "Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement", "source": {"advisory": "GHSA-r553-m4fv-5v97", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.30.5"}]}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97", "name": "https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c", "name": "https://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/axllent/mailpit/releases/tag/v1.30.5", "name": "https://github.com/axllent/mailpit/releases/tag/v1.30.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:15:06.567Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67447", "state": "PUBLISHED", "dateUpdated": "2026-08-21T16:19:21.564Z", "dateReserved": "2026-07-29T15:07:24.992Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T21:15:06.567Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mailpit", "vendor": "axllent", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.30.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5."}, {"lang": "es", "value": "Mailpit es una herramienta de prueba de correo electr\u00f3nico y API para desarrolladores. Desde la versi\u00f3n 1.30.0 hasta la 1.30.5, la funci\u00f3n readData() de internal/smtpd/smtpd.go de Mailpit llama a bufio.Reader.ReadBytes antes de aplicar la verificaci\u00f3n de tama\u00f1o len(data)+len(line) a la l\u00ednea SMTP DATA completada contra Server.MaxSize. Un cliente SMTP no autenticado puede enviar una sola l\u00ednea m\u00e1s grande que el MaxMessageSize configurado, lo que provoca que la l\u00ednea completa se asigne antes de que Mailpit devuelva el rechazo 552 5.3.4. Esta brecha posterior a la correcci\u00f3n permanece despu\u00e9s de que la acumulaci\u00f3n normal de DATA de varias l\u00edneas fuera limitada, y las l\u00edneas sobredimensionadas concurrentes pueden crear una presi\u00f3n de memoria sustancial m\u00e1s all\u00e1 del l\u00edmite de tama\u00f1o de mensaje configurado. Este problema est\u00e1 solucionado en la versi\u00f3n 1.30.5."}], "id": "CVE-2026-67447", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67447", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T16:18:52.447416Z", "version": "2.0.3"}}]}, "published": "2026-08-20T22:17:56.720", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c"}, {"source": "security-advisories@github.com", "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.30.0,1.30.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mailpit", "source": "cna", "vendor": "axllent"}, "product": "mailpit", "vendor": "axllent"}], "created": "2026-08-20T22:45:02.857583+00:00", "updated": "2026-08-21T01:00:04.537269+00:00", "vendors": ["axllent", "axllent$PRODUCT$mailpit"]}