CVE-2026-48824 Details
Description
Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes") wrapped only `POST /api/v1/send` with `http.MaxBytesReader`. The four other Mailpit JSON-body API endpoints `PUT /api/v1/messages` (SetReadStatus), `DELETE /api/v1/messages` (DeleteMessages), `PUT /api/v1/tags` (SetMessageTags), and `POST /api/v1/message/{id}/release` (ReleaseMessage) still call `json.NewDecoder(r.Body)` directly with no body-size cap and remain reachable unauthenticated in the default `docker run axllent/mailpit:latest` deploy. An unauthenticated remote attacker can post a multi-million-element `IDs` slice and drive RSS from ~25 MiB baseline to ~450 MiB per 16 MB request body. Repeating across multiple connections accumulates the same per-request amplification per process. Version 1.30.1 contains a patch.
A denial-of-service vulnerability has been identified in Mailpit, an email testing tool for developers, in versions prior to 1.30.1. The issue arises in four JSON-body API endpoints: 'PUT /api/v1/messages', 'DELETE /api/v1/messages', 'PUT /api/v1/tags', and 'POST /api/v1/message/{id}/release'. These endpoints, which remain unauthenticated in the default Docker deployment, allow remote attackers to send large payloads that exhaust server memory. This vulnerability was introduced because the endpoints do not have a body-size limit, unlike the 'POST /api/v1/send' endpoint, which was properly capped. As a result, an attacker can drive the server's resident set size (RSS) from a baseline of approximately 25 MiB to around 450 MiB per 16 MB request, with the memory exhaustion compounding across multiple connections.
Users can upgrade to Mailpit version 1.30.1, which patches the vulnerability by applying a body-size limit to all JSON API endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axllent/mailpit/releases/tag/v1.30.1 | [email protected] | Release Notes |
| https://github.com/axllent/mailpit/security/advisories/GHSA-28pq-6qxg-wg5r | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| axllent mailpit | < 1.30.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |