CVE-2026-67447

Executive Summary

CVE-2026-67447 is a memory resource exhaustion vulnerability in the Mailpit email testing tool and API, affecting versions 1.30.0 through 1.30.4. The flaw resides in the SMTP data handling logic where the readData() function in internal/smtpd/smtpd.go fails to enforce the configured Server.MaxSize limit until after the entire DATA line has been buffered into memory. An unauthenticated remote attacker can exploit this by sending oversized SMTP DATA lines, potentially exhausting server memory and causing a denial-of-service (DoS) condition. The vulnerability is fixed in version 1.30.5.

Technical Analysis

Mailpit is an email testing tool that provides an SMTP server interface for developers to capture and inspect outgoing emails during development and testing. The vulnerable code path resides in the SMTP daemon implementation, specifically within the readData() function located in internal/smtpd/smtpd.go.

The vulnerability exists because of an ordering flaw in the data-size validation logic. The function calls bufio.Reader.ReadBytes to read an entire line of SMTP DATA content before checking whether the accumulated size (len(data)+len(line)) exceeds the configured Server.MaxSize limit. This ordering issue means that the size check is applied only after the line has already been read into memory, not before. The intended behavior — imposing a maximum message size limit — is therefore ineffective for a single oversized line.

Important scope note: this vulnerability is described as a "post-fix gap." That is, an earlier fix successfully bounded memory consumption for normal multi-line DATA accumulation (where a message is built from many smaller lines). However, a single line larger than the configured max size bypasses that earlier mitigation. The check that governs multi-line accumulation does not protect against the single-line case.

The allocation risk is compounded by concurrency. Mailpit's SMTP server handles multiple concurrent client connections. An attacker who opens several simultaneous SMTP sessions and sends oversized DATA lines on each can create substantial aggregate memory pressure, far exceeding the per-message cap defined by Server.MaxSize. Because the allocation happens before the rejection (552 5.3.4 response), the memory is consumed even though the message is ultimately refused.

The vulnerability class is CWE-770: Allocation of Resources Without Limits or Throttling. The resource in question is heap memory, consumed by buffering oversized lines. The attacker requires no authentication, as SMTP DATA submission does not require prior credentials in Mailpit's default configuration.

Attack surface: The SMTP listener port (typically 1025 by default for Mailpit) is exposed to any network reachable by the application. Since Mailpit is a development tool, it may be bound to a management interface, localhost, or a broader network depending on deployment. Any instance exposed beyond the local developer machine is vulnerable to this unauthenticated resource exhaustion.

Exploitation Scenarios

Based strictly on the NVD description, the attack chain is as follows:

1. Reconnaissance / Target Identification: An attacker identifies a Mailpit instance with an exposed SMTP port. This may be accomplished via SMTP service banner grabbing (the banner may identify Mailpit), port scanning for common dev-tool SMTP ports (1025, 2525, etc.), or via network discovery of development/test infrastructure. No authentication is required at any stage.

2. Vulnerability Trigger: The attacker establishes an SMTP connection to the server and issues the EHLO/MAIL FROM/RCPT TO commands, followed by the DATA command. Instead of sending a multi-line message within normal size bounds, the attacker sends a single DATA line exceeding the configured Server.MaxSize limit. The vulnerable readData() function reads this entire line into memory via bufio.Reader.ReadBytes before the size check is applied.

3. Payload / Execution Method: The "payload" here is simply an oversized SMTP DATA line. The attacker can vary line size to optimize memory consumption. Because the size check is performed post-read, the full line is allocated in heap memory even though the server later responds with a 552 5.3.4 rejection. To amplify impact, the attacker opens multiple concurrent SMTP sessions, each transmitting oversized lines simultaneously, multiplying memory consumption well beyond the intended per-message cap.

4. Post-Exploitation Impact: The immediate impact is memory exhaustion. If sufficient concurrent connections are opened and large enough lines are sent, the Mailpit process may consume all available heap memory, leading to process slowdowns, crashes, or outright termination. In a containerized or shared environment, this can also degrade adjacent services. The availability impact (CVSS base score A:L) reflects a low-level availability degradation, though in practice, sustained or amplified attacks may exceed the low rating.

No public PoC is available for this CVE. The attack chain above is inferred strictly from the vulnerability class (CWE-770) and the described mechanism in the NVD description. No specific code patterns or hypothetical implementation details are fabricated.

Impact Assessment

• Confidentiality Impact: None (C:N in CVSS)
• Integrity Impact: None (I:N in CVSS)
• Availability Impact: Low (A:L in CVSS)
• CVSS Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) — exploitable remotely
• Attack Complexity: Low (AC:L) — straightforward SMTP transaction
• Privileges Required: None (PR:N) — no authentication needed
• User Interaction: None (UI:N)

Business Impact: Mailpit is primarily a development/testing tool. A successful DoS attack disrupts email capture and inspection capabilities, which can impede development workflows, CI/CD pipelines that rely on Mailpit for email testing, and integration testing procedures. If Mailpit is used in shared development environments or exposed on the network, the blast radius extends to all teams relying on the instance.

Affected Systems: Mailpit versions 1.30.0 through 1.30.4. Instances bound to non-loopback interfaces or accessible on internal networks face the highest risk. The tool's purpose (local email testing) means many deployments listen on localhost only; however, containerized deployments or team-shared instances may expose the SMTP port more broadly.

Blast Radius: The memory exhaustion is confined to the Mailpit process itself; there is no evidence of lateral movement or data compromise. However, in resource-constrained environments (small containers, shared VPS), the memory pressure may impact co-tenant processes. The lack of authentication and low attack complexity make this trivially exploitable by any network-reachable attacker.

Risk Assessment: While the CVSS base score is Medium (5.3), the true risk is deployment-dependent. Instances bound to localhost pose little real-world risk. Instances exposed on corporate networks, VPNs, or the public internet face a realistic DoS threat. The vulnerability's simplicity (no auth, low complexity, no interaction) drives the attack potential upward despite the modest base score.

Detection Guidance

The following detection rules focus on identifying oversized SMTP DATA lines, anomalous SMTP connection patterns, and memory pressure anomalies in Mailpit.

Sigma Rule

title: Mailpit Oversized SMTP DATA Line - DoS Attempt
id: 8d3b9f9c-9f81-4e0d-a2b3-1f6f4b0d2c3e
status: experimental
description: Detects SMTP DATA lines exceeding typical message size limits against Mailpit
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-67447
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: application
    product: mailpit
detection:
    selection:
        smtp.response|contains: "552 5.3.4"
    condition: selection
falsepositives:
    - Legitimate large email messages if MaxSize is configured too high
level: medium
tags:
    - attack.t1190
    - cve.2026-67447
    - cwe.770

YARA Rule

rule Mailpit_SMTP_Oversized_Data_Line
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SMTP DATA line patterns consistent with CVE-2026-67447 exploitation"
        cve = "CVE-2026-67447"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $smtp_cmd = "DATA\r\n" ascii
        $smtp_rej = "552 5.3.4" ascii
        $mailpit_banner = "Mailpit" ascii nocase
    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> any 1025 (msg:"MAILPIT CVE-2026-67447 Potential SMTP DATA Line Oversize DoS Attempt"; flow:established,to_server; content:"DATA|0d 0a|"; nocase; within:50; pcre:"/DATA\r\n(?:.{1,})/s"; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-67447; sid:2026744701; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where destination.port == 1025 and network.protocol == "smtp" and process.name == "mailpit"]
  [network where destination.port == 1025 and network.protocol == "smtp" and bytes_sent > 1000000]
  [process where process.name == "mailpit" and event.action == "process.died"]

Splunk SPL Query

index=main sourcetype=mailpit
| where like(smtp_response, "%552 5.3.4%")
| stats count by client_ip, _time
| eventstats avg(smtp_data_line_size) as avg_line_size
| where avg_line_size > 1000000
| eval threat_score = count * (avg_line_size / 1000000)
| sort threat_score desc
| table client_ip, count, avg_line_size, threat_score

Wazuh OSSEC Rule

<group name="mailpit,">
  <rule id="100674" level="8">
    <decoded>552 5.3.4</decoded>
    <description>Mailpit SMTP oversized DATA line rejected - potential DoS attempt (CVE-2026-67447)</description>
    <group>mailpit,smtp,attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (relative to currently tracked sources; however, the NVD description explicitly states the fix is in version 1.30.5).

1. Immediate Mitigations:

   • Upgrade to Mailpit version 1.30.5 or later, which contains the fix for this vulnerability.
   • If immediate upgrade is not possible, restrict network access to the SMTP port. Bind Mailpit to localhost or a firewall-protected management network only.
   • Implement network-level rate limiting and connection throttling on the SMTP port to limit the number of concurrent connections from a single source.
   • Use reverse-proxy or firewall rules to also limit the maximum TCP segment size or block single SMTP DATA lines exceeding a reasonable threshold.

2. Patch/Upgrade Steps:

   • Download Mailpit 1.30.5 from the official release channel.
   • Validate the version checksum before deployment.
   • Apply the upgrade in the target environment.
   • Verify that message size enforcement works post-upgrade by sending an oversized DATA line and confirming the 552 5.3.4 rejection occurs without memory spike.

3. Long-Term Hardening:

   • Keep Mailpit on a dedicated non-routable interface unless remote access is strictly required.
   • Implement SMTP-level message size enforcement at the perimeter (e.g., a hardened relay before Mailpit).
   • Runtime memory limits: run Mailpit in a container with a strict memory cgroup limit so any future memory exhaustion affects only the Mailpit container.
   • Monitor memory usage continuously with threshold-based alerting.
   • Subscribe to Mailpit issue trackers and release channels to receive timely notification of security fixes.
   • Consider whether the SMTP listener needs to accept connections from all interfaces; this is rarely necessary for a development tool.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-67447
2. Mailpit Project GitHub (release/source): https://github.com/axllent/mailpit
3. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/
4. CWE-770 (Allocation of Resources Without Limits or Throttling): https://cwe.mitre.org/data/definitions/770.html

Threat Actor Activity: No known threat actor campaigns or in-the-wild exploitation evidence exists for CVE-2026-67447 as of the writing of this report. The vulnerability is not listed in the CISA KEV catalog. The absence of public PoC or known exploit activity reduces the immediate threat level, though the vulnerability's simplicity (unauthenticated, low complexity) suggests it is trivially weaponizable once discovered by adversarial researchers.