CVE-2026-67446: CWE-400: Uncontrolled Resource Consumption in axllent mailpit

Mailpit's /api/v1/message/{id}/part/{partID}/thumb endpoint decodes image attachments fully into memory before any checks on decoded pixel dimensions or memory budget. This allows an attacker with the ability to store an email and access the API to supply a small compressed image with large declared dimensions, causing the server to allocate and process a large decoded raster image (e.g., a 65 KB PNG expanding to ~67 MB in memory) before scaling it down to a 180x120 thumbnail. The vulnerability arises because the decoding step happens prior to any resource usage validation, leading to uncontrolled resource consumption (CWE-400). The issue is confirmed by proof-of-concept code demonstrating the amplification from encoded size to decoded raster size. The affected versions are all versions before 1.30.4.

An attacker who can store an email with a crafted image attachment and access the mailpit API can cause excessive CPU and memory consumption on the server by forcing it to decode large images from small compressed attachments. This can degrade service availability or cause denial of service due to resource exhaustion. There is no indication of confidentiality or integrity impact. The CVSS 3.1 base score is 5.3 (medium), reflecting the availability impact without requiring privileges or user interaction.

A fix is available in mailpit version 1.30.4. Users should upgrade to version 1.30.4 or later to remediate this vulnerability. Until upgraded, avoid processing untrusted image attachments or restrict API access to trusted clients. The vendor advisory confirms the patch status. No additional mitigation is required once patched.