{"id":"CVE-2026-67447","revision":"748972163a22447f81290e8fa3686bfa","records":[{"revision":"748972163a22447f81290e8fa3686bfa","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-67447","aliases":[],"title":"Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement","description":"Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.","state":0,"publishedAt":"2026-08-20T21:15:06.567+00:00","modifiedAt":"2026-08-21T16:19:21.564+00:00","affected":[{"ecosystem":"Vendor product","name":"mailpit","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"axllent\",\n                    \"product\": \"mailpit\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.30.0, < 1.30.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97","https://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c","https://github.com/axllent/mailpit/releases/tag/v1.30.5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-67447","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-67447","identifiers":["CVE-2026-67447"]},"retained":false,"historicalAffected":[]}],"coverage":[]}