{"id":"EUVD-2026-63664","enisaUuid":"ddaae08d-5e5b-3ded-b5c9-bc78627e41b4","description":"Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit\u0027s internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.","datePublished":"Aug 20, 2026, 9:15:06 PM","dateUpdated":"Aug 21, 2026, 4:19:21 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97\nhttps://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.5\n","aliases":"CVE-2026-67447\nGHSA-r553-m4fv-5v97\n","assigner":"GitHub_M","epss":0.51,"enisaIdProduct":[{"id":"3964c112-05e0-331b-97ad-84014411bee8","product":{"name":"mailpit","vendor":{"name":"axllent"}},"product_version":"1.30.0, \u003c 1.30.5"}],"enisaIdVendor":[{"id":"74312c84-573e-3033-bfa3-0e8e70d54660","vendor":{"name":"axllent"}}],"enisaIdVulnerability":[{"id":"409564d2-0a3f-3845-a87d-fd9a01d20b26","vulnerability":{"id":"GHSA-r553-m4fv-5v97","description":"Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement","datePublished":"Aug 20, 2026, 9:34:52 PM","dateUpdated":"Sep 2, 2026, 11:40:36 PM","baseScore":0.0,"references":"https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67447\nhttps://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c\nhttps://github.com/axllent/mailpit\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.5\n","enisa_id":"EUVD-2026-63664\n","aliases":"GHSA-r553-m4fv-5v97\nCVE-2026-67447\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d23cd4de-0ec6-3629-8fef-13e93ec1cc31","vulnerability":{"id":"CVE-2026-67447","description":"Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit\u0027s internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.","datePublished":"Aug 20, 2026, 9:15:06 PM","dateUpdated":"Aug 21, 2026, 4:19:21 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97\nhttps://github.com/axllent/mailpit/commit/8720c6bd8281fc00d458081908f1dbef8e59a98c\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.5\n","enisa_id":"EUVD-2026-63664\n","assigner":"GitHub_M","epss":0.51,"dataProcessed":"Nov 7, 2026, 7:19:43 AM","vulnerabilityProduct":[{"id":"5ea45498-6c71-3f94-8ee6-3ef53361f008","product":{"name":"mailpit","vendor":{"name":"axllent"}},"product_version":"1.30.0, \u003c 1.30.5"}],"vulnerabilityVendor":[{"id":"075c0c3a-a07e-36a8-95c5-169d1b346865","vendor":{"name":"axllent"}}]}}],"enisaIdAdvisory":[]}