Axllent Mailpit vulnerabilities

• axllent mailpit Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix CVE-2026-84697 6.9 MediumSeptember 2, 2026
• axllent mailpit Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) CVE-2026-67448 Fix available 6.5 MediumAugust 20, 2026
• axllent mailpit Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement CVE-2026-67447 Fix available 5.3 MediumAugust 20, 2026
• axllent mailpit Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection CVE-2026-67445 Fix available 5.3 MediumAugust 20, 2026
• axllent mailpit Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling CVE-2026-67446 Fix available 5.3 MediumAugust 20, 2026
• axllent mailpit Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw) CVE-2026-48824 Fix available 5.3 MediumJuly 1, 2026
• axllent mailpit Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) CVE-2026-55187 Fix available 5.8 MediumJune 19, 2026
• axllent mailpit Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes CVE-2026-45713 Fix available 7.5 HighMay 19, 2026
• axllent mailpit Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write) CVE-2026-45712 Fix available 5.9 MediumMay 19, 2026
• axllent mailpit Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs CVE-2026-45711 Fix available 5.9 MediumMay 19, 2026
• axllent mailpit Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer CVE-2026-45709 Fix available 5.8 MediumMay 19, 2026
• axllent mailpit Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API CVE-2026-27808 Fix available 5.8 MediumFebruary 25, 2026
• axllent mailpit Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API CVE-2026-23845 Fix available 5.8 MediumJanuary 19, 2026
• axllent mailpit Mailpit has SMTP Header Injection via Regex Bypass CVE-2026-23829 Public exploitFix available 5.3 MediumJanuary 18, 2026
• axllent mailpit Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails CVE-2026-22689 Fix available 6.5 MediumJanuary 10, 2026
• axllent mailpit Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF) CVE-2026-21859 Fix available 5.8 MediumJanuary 6, 2026