{"id":"CVE-2026-45713","sourceIdentifier":"security-advisories@github.com","published":"2026-07-20T16:17:00.610","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value (0 ⇒ \"no limit\"). The same applies to the HTTP /api/v1/send endpoint, whose request body is decoded with json.NewDecoder(r.Body) and no http.MaxBytesReader. Because Mailpit's default listeners bind [::]:1025 (SMTP) and [::]:8025 (HTTP), with no authentication required on either, a single network-reachable attacker can push an arbitrarily large message into Mailpit and watch RAM consumption spike with a ~7-10× amplification factor (raw frame → enmime envelope tree → search-text index → zstd-encoded write to SQLite). Repeating the attack — or running it concurrently from multiple connections — drives the process to OOM-kill. Version 1.30.0 contains a patch."},{"lang":"es","value":"Mailpit es una herramienta de prueba de correo electrónico y API para desarrolladores. Antes de la versión 1.30.0, el servidor SMTP de Mailpit tiene un campo int Server.MaxSize que controla el tamaño máximo permitido de la carga útil DATA, pero el campo nunca se asigna en ningún lugar fuera del código de prueba, dejándolo en el valor cero de Go (0 ? ’sin límite’). Lo mismo se aplica al endpoint HTTP /api/v1/send, cuyo cuerpo de solicitud se decodifica con json.NewDecoder(r.Body) y sin http.MaxBytesReader. Debido a que los oyentes predeterminados de Mailpit se enlazan a [::]:1025 (SMTP) y [::]:8025 (HTTP), sin autenticación requerida en ninguno de ellos, un único atacante accesible por red puede introducir un mensaje arbitrariamente grande en Mailpit y observar cómo el consumo de RAM se dispara con un factor de amplificación de ~7-10× (marco sin procesar ? árbol de sobres enmime ? índice de texto de búsqueda ? escritura codificada en zstd a SQLite). Repetir el ataque - o ejecutarlo concurrentemente desde múltiples conexiones - lleva el proceso a un OOM-kill. La versión 1.30.0 contiene un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"axllent","product":"mailpit","versions":[{"version":"< 1.30.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-20T16:16:33.595846Z","id":"CVE-2026-45713","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*","versionEndExcluding":"1.30.0","matchCriteriaId":"3ECED29B-387E-4170-B0E7-1818C63ADB60"}]}]}],"references":[{"url":"https://github.com/axllent/mailpit/releases/tag/v1.30.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/axllent/mailpit/security/advisories/GHSA-fpxj-m5q8-fphw","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/axllent/mailpit/security/advisories/GHSA-fpxj-m5q8-fphw","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}