{"id":"EUVD-2026-63659","enisaUuid":"9147554a-7609-3fe8-a795-48101e135034","description":"Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4.","datePublished":"Aug 20, 2026, 9:10:28 PM","dateUpdated":"Aug 21, 2026, 2:56:09 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39\nhttps://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.4\n","aliases":"CVE-2026-67446\nGHSA-75mr-qw9x-3r39\n","assigner":"GitHub_M","epss":0.51,"enisaIdProduct":[{"id":"aed38254-9837-3add-a1aa-1dfb55cb11dc","product":{"name":"mailpit","vendor":{"name":"axllent"}},"product_version":"\u003c 1.30.4"}],"enisaIdVendor":[{"id":"6235d0ba-4aeb-3ae3-bab1-ae98f419d0d0","vendor":{"name":"axllent"}}],"enisaIdVulnerability":[{"id":"1dc2e56c-2892-31ba-9027-5858e3c713bc","vulnerability":{"id":"CVE-2026-67446","description":"Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4.","datePublished":"Aug 20, 2026, 9:10:28 PM","dateUpdated":"Aug 21, 2026, 2:56:09 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39\nhttps://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.4\n","enisa_id":"EUVD-2026-63659\n","assigner":"GitHub_M","epss":0.51,"dataProcessed":"Nov 3, 2026, 7:15:49 AM","vulnerabilityProduct":[{"id":"ea872f22-fc0e-39a4-b1e7-4606f3e2efac","product":{"name":"mailpit","vendor":{"name":"axllent"}},"product_version":"\u003c 1.30.4"}],"vulnerabilityVendor":[{"id":"7db6ff59-31f7-3d6c-8b05-b8c750c981a8","vendor":{"name":"axllent"}}]}},{"id":"a6745d70-d738-3af3-920d-cdcb68a73f1c","vulnerability":{"id":"GHSA-75mr-qw9x-3r39","description":"Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling","datePublished":"Sep 2, 2026, 11:39:08 PM","dateUpdated":"Sep 2, 2026, 11:39:08 PM","baseScore":0.0,"references":"https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67446\nhttps://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35\nhttps://github.com/axllent/mailpit\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.4\n","enisa_id":"EUVD-2026-63659\n","aliases":"CVE-2026-67446\nGHSA-75mr-qw9x-3r39\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}