CVE-2026-67447: CWE-770: Allocation of Resources Without Limits or Throttling in axllent mailpit

Mailpit's SMTP server enforces a MaxMessageSize limit by assigning it to srv.MaxSize. However, the SMTP DATA reader reads a full line terminated by '\n' into memory before checking if the accumulated data exceeds srv.MaxSize. This means an attacker can send a single DATA line larger than the configured cap, causing the server to allocate memory for that entire line before rejecting the message with a 552 error. The default MaxMessageSize is 50 MiB, but a 64 MiB single line can still be buffered, leading to excessive memory use. This vulnerability is a post-fix gap following an earlier SMTP DATA body-size advisory, where multi-line accumulation is bounded but individual lines are not. The affected versions are >=1.30.0 and <1.30.5.

An unauthenticated remote attacker can cause the mailpit SMTP server to allocate excessive memory by sending a single oversized DATA line exceeding the configured MaxMessageSize. This can lead to resource exhaustion and potential denial of service due to uncontrolled memory allocation. There is no indication of confidentiality or integrity impact. The CVSS score is 5.3 (medium severity) with an impact on availability only.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider limiting exposure of the SMTP service or applying external rate limiting or connection controls to mitigate resource exhaustion risks. Avoid relying solely on the MaxMessageSize setting to prevent large single-line messages.