CyberRota Analysis
AI-GeneratedMailpit versions 1.30.0 to 1.30.5 are vulnerable due to a flaw in the readData() function, which allows unauthenticated SMTP clients to send oversized single lines that exceed the configured MaxMessageSize. This can lead to excessive memory allocation and potential denial of service due to memory pressure. Developers using Mailpit for email testing should prioritize upgrading to version 1.30.5 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.