https://vulnerability.circl.lu/sightings/feed 2026-09-03T10:29:36.817243+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3f1d303a-4963-439f-a7b5-afd1d8f36d86/export 2026-09-03T10:29:36.845440+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3f1d303a-4963-439f-a7b5-afd1d8f36d86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67445", "type": "seen", "source": "https://gist.github.com/alon710/25d950fb1b775a5961200e6e2792284d", "content": "# CVE-2026-67445: CVE-2026-67445: Uncontrolled Memory Resource Consumption in Mailpit SMTP and POP3 Services\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67445\n\n## Summary\nAn uncontrolled resource consumption vulnerability in Mailpit versions prior to 1.30.4 allows remote, unauthenticated attackers to cause a denial of service (DoS) by sending unbounded command lines to the SMTP and POP3 servers. This memory exhaustion condition bypasses maximum message size limits.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust system memory and crash Mailpit by streaming long commands without a newline character to the SMTP or POP3 ports.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS**: 5.3\n- **EPSS**: 0.00371 (30.14th percentile)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mailpit SMTP Server\n- Mailpit POP3 Server\n- **mailpit**: < 1.30.4 (Fixed in: `1.30.4`)\n\n## Mitigation\n\n- Upgrade the Mailpit package to version 1.30.4 or higher.\n- Restrict SMTP (port 1025) and POP3 (port 1110) traffic to local development networks or loopback interfaces.\n- Configure container memory limits to prevent host system crashes during memory exhaustion events.\n- Implement automatic process restart policies via systemd or Kubernetes to recover from crashes.\n\n**Remediation Steps:**\n1. Pull the latest Mailpit docker image: docker pull axllent/mailpit:latest\n2. If running local binaries, download v1.30.4 or rebuild using: go install github.com/axllent/mailpit@v1.30.4\n3. Apply firewall configurations restricting access to port 1025 and 1110.\n4. Verify the patch by running the memory consumption proof-of-concept against the updated service.\n\n## References\n\n- [GitHub Security Advisory GHSA-w878-pj84-3j5v](https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v)\n- [Mailpit Release Tag v1.30.4](https://github.com/axllent/mailpit/releases/tag/v1.30.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67445) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T05:32:21.089504Z"} 2026-09-03T05:32:21.089504+00:00 https://vulnerability.circl.lu/sighting/bfc6b5d4-248b-412a-ae2e-61d58011d881/export 2026-09-03T10:29:36.848233+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "bfc6b5d4-248b-412a-ae2e-61d58011d881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67445", "type": "published-proof-of-concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v", "content": "", "creation_timestamp": "2026-09-03T00:35:02.806746Z"} 2026-09-03T00:35:02.806746+00:00