{"vulnerability": "CVE-2026-67446", "sightings": [{"uuid": "4b29960e-df06-428a-9b06-4ff90f3eab07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67446", "type": "published-proof-of-concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "content": "", "creation_timestamp": "2026-09-03T00:35:04.991658Z"}, {"uuid": "6cd80f24-c129-4fa8-94f0-f49cd5785a1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67446", "type": "seen", "source": "https://gist.github.com/alon710/3dcd56ab41cf2fc234bc88855814c85c", "content": "# CVE-2026-67446: CVE-2026-67446: Unbounded Image Dimension Decoding in Mailpit Thumbnail Generation\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67446\n\n## Summary\nMailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. This allows remote, unauthenticated attackers to trigger unconstrained memory allocation and cause a Denial of Service (DoS) via resource exhaustion.\n\n## TL;DR\nUnauthenticated remote attackers can crash Mailpit servers by transmitting email attachments containing compressed images with extremely large logical dimensions, triggering out-of-memory errors during thumbnail generation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: Proof of Concept\n- **Impact**: Denial of Service (DoS)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mailpit\n- **Mailpit**: < v1.30.4 (Fixed in: `v1.30.4`)\n\n## Mitigation\n\n- Restrict access to the SMTP and HTTP interfaces of Mailpit to local or authorized developers.\n- Enforce local binding (127.0.0.1) for testing environments to prevent remote network access.\n\n**Remediation Steps:**\n1. Upgrade Mailpit to version v1.30.4 or higher.\n2. Configure automated container restart policies for recovery in case of resource exhaustion.\n\n## References\n\n- [GitHub Security Advisory GHSA-75mr-qw9x-3r39](https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39)\n- [Patch Commit](https://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35)\n- [Mailpit v1.30.4 Release Tag](https://github.com/axllent/mailpit/releases/tag/v1.30.4)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67446)\n- [CVE Org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-67446)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67446) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T07:31:59.621221Z"}]}