Security
فارسی
All products

github.com/axllent/mailpit

Go · Package
15 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejectionCVE-2026-67445 · GHSA-W878-PJ84-3J5VVersion ranges need review. github.com/axllent/mailpit Go High Fix reported
Mailpit: Thumbnail generation decodes unbounded image dimensions before scalingCVE-2026-67446 · GHSA-75MR-QW9X-3R39Version ranges need review. github.com/axllent/mailpit Go High Fix reported
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)CVE-2026-67448 · GHSA-8R62-W5WH-FC5MVersion ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcementCVE-2026-67447 · GHSA-R553-M4FV-5V97Version ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanismsCVE-2026-55187 · GHSA-W4MC-HHC6-XP28Version ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)CVE-2026-48824 · GHSA-28PQ-6QXG-WG5RVersion ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizesCVE-2026-45713 · GHSA-FPXJ-M5Q8-FPHWVersion ranges need review. github.com/axllent/mailpit Go High Fix reported
Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)CVE-2026-45712 · GHSA-W4VJ-R5PG-3722Version ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDsCVE-2026-45711 · GHSA-QX5X-85P8-VG4JVersion ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialerCVE-2026-45709 · GHSA-J3FJ-QPPJ-FMMCVersion ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check APICVE-2026-27808 · GHSA-MPF7-P9X7-96R3Version ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check APICVE-2026-23845 · GHSA-6JXM-FV7W-RW5JVersion ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit has an SMTP Header Injection via Regex BypassCVE-2026-23829 · GHSA-54WQ-72MP-CQ7CVersion ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerabilityCVE-2026-21859 · GHSA-8V65-47JX-7MFRVersion ranges need review. github.com/axllent/mailpit Go Medium Fix reported
Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emailsCVE-2026-22689 · GHSA-524M-Q5M7-79MMVersion ranges need review. github.com/axllent/mailpit Go Medium Fix reported