CVE-2026-45713 describes a resource exhaustion vulnerability in Mailpit's SMTP server and HTTP /api/v1/send endpoint prior to version 1.30.0. The Server.MaxSize integer field, intended to limit the maximum allowed DATA payload size, is never assigned outside test code, defaulting to zero which means no limit. The HTTP endpoint similarly lacks request body size limits. Both listeners bind to network-accessible ports without authentication, allowing remote attackers to send arbitrarily large messages. These messages cause amplified RAM consumption through internal processing steps, potentially leading to out-of-memory kills. The vulnerability is fixed in Mailpit 1.30.0.

An unauthenticated remote attacker can cause Mailpit to consume excessive memory by sending very large email messages or HTTP requests. This can lead to denial of service via process termination (OOM kill). There is no impact on confidentiality or integrity reported. The CVSS 3.1 base score is 7.5 (High) reflecting network attack vector, no privileges required, no user interaction, and high impact on availability.

Version 1.30.0 of Mailpit contains a patch that properly enforces maximum payload sizes to prevent uncontrolled resource consumption. Users should upgrade to version 1.30.0 or later. No other official remediation or temporary fixes are documented. Until patched, restricting network access to Mailpit's SMTP and HTTP ports can reduce exposure.