Mailpit versions before 1.30.1 contain a resource exhaustion vulnerability (CWE-770) in four unauthenticated JSON-body API endpoints: PUT /api/v1/messages, DELETE /api/v1/messages, PUT /api/v1/tags, and POST /api/v1/message/{id}/release. Unlike the previously fixed POST /api/v1/send endpoint, these endpoints do not limit the size of the request body, allowing an attacker to send very large JSON payloads (multi-million-element ID slices). This causes the process's resident set size (RSS) memory usage to increase significantly (from ~25 MiB baseline to ~450 MiB per 16 MB request), enabling denial of service via memory exhaustion. Version 1.30.1 contains a patch that addresses this issue.

An unauthenticated remote attacker can exploit this vulnerability to cause excessive memory consumption on the Mailpit server by sending large JSON payloads to specific API endpoints. This can lead to denial of service conditions due to resource exhaustion, impacting availability. There is no impact on confidentiality or integrity according to the CVSS vector.

A patch is available in Mailpit version 1.30.1 that fixes this vulnerability by adding request body size limits to the affected endpoints. Users should upgrade to version 1.30.1 or later to remediate this issue. No other mitigation guidance is provided or necessary as the vulnerability is fixed in the stated version.