{"metadata": {"vulnerability": "CVE-2026-67446", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-29T15:07:24.992Z", "date_only": false, "value": "2026-07-29T15:07:24.992Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-67446", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-20T21:10:28.074Z", "date_only": false, "value": "2026-08-20T21:10:28.074Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67446", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-20T21:10:28.074Z", "date_only": false, "value": "2026-08-20T21:10:28.074Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-67446", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-20T21:17:07Z", "date_only": false, "value": "2026-08-20T21:17:07Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-75MR-QW9X-3R39", "record": "GHSA-75MR-QW9X-3R39", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-08-20T21:17:07.260Z", "date_only": false, "value": "2026-08-20T21:17:07.260", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67446", "record": "FKIE_CVE-2026-67446", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-21T14:56:02.744Z", "date_only": false, "value": "2026-08-21T14:56:02.744495Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-67446", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-21T14:56:02.744Z", "date_only": false, "value": "2026-08-21T14:56:02.744495Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67446", "record": "FKIE_CVE-2026-67446", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-08-21T14:56:09.415Z", "date_only": false, "value": "2026-08-21T14:56:09.415Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-67446", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-21T14:56:09.415Z", "date_only": false, "value": "2026-08-21T14:56:09.415Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-67446", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-02T23:39:08Z", "date_only": false, "value": "2026-09-02T23:39:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-75MR-QW9X-3R39", "record": "GHSA-75MR-QW9X-3R39", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-02T23:39:08Z", "date_only": false, "value": "2026-09-02T23:39:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-75MR-QW9X-3R39", "record": "GHSA-75MR-QW9X-3R39", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-03T00:35:04.991Z", "date_only": false, "value": "2026-09-03T00:35:04.991658Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "record": "CVE-2026-67446", "field": "creation_timestamp", "uuid": "4b29960e-df06-428a-9b06-4ff90f3eab07", "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-03T07:31:59.621Z", "date_only": false, "value": "2026-09-03T07:31:59.621221Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/3dcd56ab41cf2fc234bc88855814c85c", "record": "CVE-2026-67446", "field": "creation_timestamp", "uuid": "6cd80f24-c129-4fa8-94f0-f49cd5785a1e", "content": "# CVE-2026-67446: CVE-2026-67446: Unbounded Image Dimension Decoding in Mailpit Thumbnail Generation\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67446\n\n## Summary\nMailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. This allows remote, unauthenticated attackers to trigger unconstrained memory allocation and cause a Denial of Service (DoS) via resource exhaustion.\n\n## TL;DR\nUnauthenticated remote attackers can crash Mailpit servers by transmitting email attachments containing compressed images with extremely large logical dimensions, triggering out-of-memory errors during thumbnail generation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: Proof of Concept\n- **Impact**: Denial of Service (DoS)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mailpit\n- **Mailpit**: < v1.30.4 (Fixed in: `v1.30.4`)\n\n## Mitigation\n\n- Restrict access to the SMTP and HTTP interfaces of Mailpit to local or authorized developers.\n- Enforce local binding (127.0.0.1) for testing environments to prevent remote network access.\n\n**Remediation Steps:**\n1. Upgrade Mailpit to version v1.30.4 or higher.\n2. Configure automated container restart policies for recovery in case of resource exhaustion.\n\n## References\n\n- [GitHub Security Advisory GHSA-75mr-qw9x-3r39](https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39)\n- [Patch Commit](https://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35)\n- [Mailpit v1.30.4 Release Tag](https://github.com/axllent/mailpit/releases/tag/v1.30.4)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67446)\n- [CVE Org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-67446)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67446) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/3dcd56ab41cf2fc234bc88855814c85c"}, {"timestamp": "2026-10-18T20:10:00.110Z", "date_only": false, "value": "2026-10-18T20:10:00.110", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67446", "record": "FKIE_CVE-2026-67446", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-07T02:55:16.501Z", "anchors": {"origin": {"timestamp": "2026-08-20T21:10:28.074Z", "date_only": false, "value": "2026-08-20T21:10:28.074Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67446", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-20T21:10:28.074Z", "date_only": false, "value": "2026-08-20T21:10:28.074Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67446", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-03T00:35:04.991Z", "date_only": false, "value": "2026-09-03T00:35:04.991658Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "record": "CVE-2026-67446", "field": "creation_timestamp", "uuid": "4b29960e-df06-428a-9b06-4ff90f3eab07", "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 1135476.917, "hours": 315.4102547222222, "days": 13.142093946759259, "min_seconds": 1135476.917, "max_seconds": 1135476.917, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-20T21:10:28.074Z", "date_only": false, "value": "2026-08-20T21:10:28.074Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67446", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-03T00:35:04.991Z", "date_only": false, "value": "2026-09-03T00:35:04.991658Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "record": "CVE-2026-67446", "field": "creation_timestamp", "uuid": "4b29960e-df06-428a-9b06-4ff90f3eab07", "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 6759888.427832, "hours": 1877.746785508889, "days": 78.23944939620371, "min_seconds": 6759888.427832, "max_seconds": 6759888.427832, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-20T21:10:28.074Z", "date_only": false, "value": "2026-08-20T21:10:28.074Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67446", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-07T02:55:16.501Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 5624411.510832, "hours": 1562.3365307866666, "days": 65.09735544944444, "min_seconds": 5624411.510832, "max_seconds": 5624411.510832, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-03T00:35:04.991Z", "date_only": false, "value": "2026-09-03T00:35:04.991658Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "record": "CVE-2026-67446", "field": "creation_timestamp", "uuid": "4b29960e-df06-428a-9b06-4ff90f3eab07", "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-07T02:55:16.501Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}