github.com/axllent/mailpit vulnerabilities (Go)

15 vulnerabilities.

• github.com/axllent/mailpit Go Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) CVE-2026-67448 Fix available 6.5 MediumAugust 20, 2026
• github.com/axllent/mailpit Go Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement CVE-2026-67447 Fix available 5.3 MediumAugust 20, 2026
• github.com/axllent/mailpit Go Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection CVE-2026-67445 Fix available 5.3 MediumAugust 20, 2026
• github.com/axllent/mailpit Go Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling CVE-2026-67446 Fix available 5.3 MediumAugust 20, 2026
• github.com/axllent/mailpit Go Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw) CVE-2026-48824 Fix available 5.3 MediumJuly 1, 2026
• github.com/axllent/mailpit Go Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) CVE-2026-55187 Fix available 5.8 MediumJune 19, 2026
• github.com/axllent/mailpit Go Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes CVE-2026-45713 Fix available 7.5 HighMay 19, 2026
• github.com/axllent/mailpit Go Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write) CVE-2026-45712 Fix available 5.9 MediumMay 19, 2026
• github.com/axllent/mailpit Go Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs CVE-2026-45711 Fix available 5.9 MediumMay 19, 2026
• github.com/axllent/mailpit Go Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer CVE-2026-45709 Fix available 5.8 MediumMay 19, 2026
• github.com/axllent/mailpit Go Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API CVE-2026-27808 Fix available 5.8 MediumFebruary 25, 2026
• github.com/axllent/mailpit Go Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API CVE-2026-23845 Fix available 5.8 MediumJanuary 19, 2026
• github.com/axllent/mailpit Go Mailpit has SMTP Header Injection via Regex Bypass CVE-2026-23829 Public exploitFix available 5.3 MediumJanuary 18, 2026
• github.com/axllent/mailpit Go Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails CVE-2026-22689 Fix available 6.5 MediumJanuary 10, 2026
• github.com/axllent/mailpit Go Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF) CVE-2026-21859 Fix available 5.8 MediumJanuary 6, 2026