Denial of Service in Mailpit Email Testing Tool
CVE-2026-48824

5.3MEDIUM

Key Information:

Vendor

Axllent

Status
Mailpit
Vendor
CVE Published:
20 July 2026

What is CVE-2026-48824?

Mailpit, an email testing tool popular among developers, is susceptible to a Denial of Service attack due to insufficient input validation on several API endpoints. Prior to version 1.30.1, certain endpoints, including PUT /api/v1/messages and DELETE /api/v1/messages, allow unauthenticated users to send excessively large JSON bodies without any size restrictions. This exploitation can lead to a significant increase in resource consumption, potentially overwhelming the server and causing service disruptions. Users are advised to upgrade to version 1.30.1 or later where this issue has been addressed.

Affected Version(s)

mailpit < 1.30.1

References

https://github.com/axllent/mailpit/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/axllent/mailpit/releases/tag/v1.30.1
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.