CVE-2026-67445

Mailpit's SMTP server, which is enabled by default and binds to all interfaces on port 1025, reads every SMTP command line with an unbounded buffered read before it parses the verb or enforces any length limit, so a client can make the server buffer a line of arbitrary size before the syntax error or read timeout kicks in (RFC 5321 caps command lines at 512 octets). An attacker with network access to the SMTP port can send a single grossly oversized command line (the advisory's test uses 8 MiB) to drive attacker-controlled memory allocation in the server, yielding an availability-only impact (CVSS 7.5, CWE-400), i.e., denial of service through memory exhaustion. Existing protections do not help here: recipient-address validation runs only after the line is fully buffered, and the 50 MiB default MaxMessageSize limit applies to the DATA phase, not to command input. Anyone running Mailpit with its SMTP listener reachable by untrusted clients is affected, including default all-interfaces deployments on shared dev servers, published Docker ports, and CI; strictly localhost-only desktop use is largely unaffected. No public PoC or in-the-wild exploitation is known; EPSS is about 0.4% (31st percentile) and the CVE is not in CISA KEV.

What to do: Upgrade to the latest Mailpit release as soon as a fix for the unbounded SMTP command-line read is published, since the available data does not name a patched version. Until then, restrict untrusted reachability of TCP 1025 (bind to localhost, firewall rules, or Docker network policy) and check whether any shared or containerized Mailpit instances expose the SMTP listener beyond trusted networks; no in-product command-line length workaround is documented.