Memory Consumption Issue in Mailpit Email Testing Tool
CVE-2026-45713

7.5HIGH

Key Information:

Vendor

Axllent

Status
Mailpit
Vendor
CVE Published:
20 July 2026

What is CVE-2026-45713?

Mailpit, an email testing tool and API utilized by developers, has a critical weakness in its SMTP server that allows attackers to exploit memory consumption. Prior to version 1.30.0, the Server.MaxSize int field, responsible for managing the maximum allowable DATA payload size, is set to Go's default zero value, indicating no limit. This flaw also affects the HTTP /api/v1/send endpoint, where the request body is processed without proper size restrictions. Consequently, an adversary can send large messages to Mailpit, leading to a significant spike in RAM usage, causing the process to terminate unexpectedly. The vulnerability can be further aggravated by simultaneous connection attempts, prompting out-of-memory termination. Version 1.30.0 addresses this issue with a patch.

Affected Version(s)

mailpit < 1.30.0

References

https://github.com/axllent/mailpit/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/axllent/mailpit/releases/tag/v1.30.0
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.