CVE-2026-67445: CWE-400: Uncontrolled Resource Consumption in axllent mailpit

Mailpit's SMTP server reads each command line using bufio.Reader.ReadString('\n') without a maximum length limit before parsing or enforcing protocol length restrictions. Although RFC 5321 limits SMTP command lines to 512 octets including CRLF, Mailpit accepts much larger lines, demonstrated by a proof-of-concept test sending an 8 MiB command line. This unbounded read allows a remote unauthenticated client to cause large heap allocations, potentially degrading or denying service. The vulnerability exists in the command reading loop and is distinct from message DATA size limits, which are enforced separately. The issue affects Mailpit versions prior to 1.30.4.

An unauthenticated remote attacker can connect to Mailpit's SMTP listener and send oversized command lines that cause the server to allocate large amounts of memory. This can lead to resource exhaustion and denial of service, impacting availability. There is no impact on confidentiality or integrity. The vulnerability does not require authentication and can be exploited remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure of the SMTP service to untrusted networks or implement external protections such as connection rate limiting or proxy filtering to restrict oversized commands.