{"id":"CVE-2026-48824","sourceIdentifier":"security-advisories@github.com","published":"2026-07-20T16:17:03.080","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, \"Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes\") wrapped only `POST /api/v1/send` with `http.MaxBytesReader`. The four other Mailpit JSON-body API endpoints  `PUT /api/v1/messages` (SetReadStatus), `DELETE /api/v1/messages` (DeleteMessages), `PUT /api/v1/tags` (SetMessageTags), and `POST /api/v1/message/{id}/release` (ReleaseMessage)  still call `json.NewDecoder(r.Body)` directly with no body-size cap and remain reachable unauthenticated in the default `docker run axllent/mailpit:latest` deploy. An unauthenticated remote attacker can post a multi-million-element `IDs` slice and drive RSS from ~25 MiB baseline to ~450 MiB per 16 MB request body. Repeating across multiple connections accumulates the same per-request amplification per process. Version 1.30.1 contains a patch."},{"lang":"es","value":"Mailpit es una herramienta de prueba de correo electrónico y una API para desarrolladores. Antes de la versión 1.30.1, la corrección para GHSA-fpxj-m5q8-fphw (CVE-2026-45710, ’Mailpit: Establecer un límite predeterminado de 50 MB p/m para prevenir DoS a través de tamaños de cuerpo ilimitados de SMTP DATA y /api/v1/send’) envolvió solo “POST /api/v1/send” con “http.MaxBytesReader”. Los otros cuatro endpoints de la API de Mailpit con cuerpo JSON “PUT /api/v1/messages” (SetReadStatus), “DELETE /api/v1/messages” (DeleteMessages), “PUT /api/v1/tags” (SetMessageTags) y “POST /api/v1/message/{id}/release” (ReleaseMessage) todavía llaman a “json.NewDecoder(r.Body)” directamente sin límite de tamaño de cuerpo y permanecen accesibles sin autenticación en el despliegue predeterminado de “docker run axllent/mailpit:latest”. Un atacante remoto no autenticado puede publicar un slice “IDs” de varios millones de elementos y llevar el RSS de una línea base de ~25 MiB a ~450 MiB por cuerpo de solicitud de 16 MB. La repetición a través de múltiples conexiones acumula la misma amplificación por solicitud por proceso. La versión 1.30.1 contiene un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"axllent","product":"mailpit","versions":[{"version":"< 1.30.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-20T19:01:37.901255Z","id":"CVE-2026-48824","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*","versionEndExcluding":"1.30.1","matchCriteriaId":"EED16083-B2DE-4607-BB41-B3239D592BCF"}]}]}],"references":[{"url":"https://github.com/axllent/mailpit/releases/tag/v1.30.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/axllent/mailpit/security/advisories/GHSA-28pq-6qxg-wg5r","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}