Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/axllent/mailpit

15 known vulnerabilities (1 high, 14 medium), with the versions each affects and the releases that fix them.

Latest release
v1.33.1 (Nov 7, 2026): no advisory affects it
Newest unaffected release
v1.33.1 (Nov 7, 2026), the latest release
Advisories
15 · 1 high, 14 medium
Releases
174 since v1.2.6 (Oct 28, 2022)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 15 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

  • CVE-2026-67448Medium 6.5

    Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

    Affected: from 1.29.0, fixed in 1.30.6.

    Fixed in v1.30.6 (released Jul 28, 2026, 23 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-67447Medium 5.3

    Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

    Affected: from 1.30.0, fixed in 1.30.5.

    Fixed in v1.30.5 (released Jul 20, 2026, 31 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-67445Medium 5.3

    Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

    Affected: fixed in 1.30.4.

    Fixed in v1.30.4 (released Jul 9, 2026, 42 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-67446Medium 5.3

    Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

    Affected: fixed in 1.30.4.

    Fixed in v1.30.4 (released Jul 9, 2026, 42 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-48824Medium 5.3

    Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and…

    Affected: fixed in 1.30.1.

    Fixed in v1.30.1 (released May 28, 2026, 53 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

    Affected: fixed in 1.30.0.

    Fixed in v1.30.0 (released May 14, 2026, 67 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-45712Medium 5.9

    Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

    Affected: fixed in 1.30.0.

    Fixed in v1.30.0 (released May 14, 2026, 67 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-45711Medium 5.9

    Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

    Affected: fixed in 1.30.0.

    Fixed in v1.30.0 (released May 14, 2026, 67 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-45709Medium 5.8

    Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

    Affected: from 1.28.3, fixed in 1.30.0.

    Fixed in v1.30.0 (released May 14, 2026, 67 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-55187Medium 5.8

    Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)

    Affected: fixed in 1.30.2.

    Fixed in v1.30.2 (released Jun 17, 2026, 23 days before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-27808Medium 5.8

    Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API

    Affected: fixed in 1.29.2.

    Fixed in v1.29.2 (released Feb 24, 2026, 1 day before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-23845Medium 5.8

    Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API

    Affected: fixed in 1.28.3.

    Fixed in v1.28.3 (released Jan 18, 2026, 1 day before disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-23829Medium 5.3

    Mailpit has SMTP Header Injection via Regex Bypass

    Affected: fixed in 1.28.3.

    Fixed in v1.28.3 (released Jan 18, 2026, the day of disclosure).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-22689Medium 6.5

    Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails

    Affected: from 1.2.6, fixed in 1.28.2; fixed in 0.0.0-20260110031614.

    Fixed in v1.28.2 (released Jan 10, 2026, the day of disclosure, the advisory names 0.0.0-20260110031614, which was never published).

    The latest release, v1.33.1, is not affected.

  • CVE-2026-21859Medium 5.8

    Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)

    Affected: fixed in 1.28.1.

    Fixed in v1.28.1 (released Jan 6, 2026, 1 day before disclosure).

    The latest release, v1.33.1, is not affected.