# github.com/axllent/mailpit (Go) vulnerabilities 15 known vulnerabilities (1 high, 14 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.33.1 (Nov 7, 2026): no advisory affects it - Newest unaffected release: v1.33.1 (Nov 7, 2026), the latest release - Releases: 174 since v1.2.6 (Oct 28, 2022) - Registry: https://pkg.go.dev/github.com/axllent/mailpit - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-67448: v1.29.0 to v1.30.5 (v1.30.6 is outside it) - CVE-2026-67447: v1.30.0 to v1.30.4 (v1.30.5 is outside it) - CVE-2026-67445: v1.2.6 to v1.30.3 (v1.30.4 is outside it) - CVE-2026-67446: v1.2.6 to v1.30.3 (v1.30.4 is outside it) - CVE-2026-48824: v1.2.6 to v1.30.0 (v1.30.1 is outside it) - CVE-2026-45713: v1.2.6 to v1.29.7 (v1.30.0 is outside it) - CVE-2026-45712: v1.2.6 to v1.29.7 (v1.30.0 is outside it) - CVE-2026-45711: v1.2.6 to v1.29.7 (v1.30.0 is outside it) - CVE-2026-45709: v1.28.3 to v1.29.7 (v1.30.0 is outside it) - CVE-2026-55187: v1.2.6 to v1.30.1 (v1.30.2 is outside it) - CVE-2026-27808: v1.2.6 to v1.29.1 (v1.29.2 is outside it) - CVE-2026-23845: v1.2.6 to v1.28.2 (v1.28.3 is outside it) - CVE-2026-23829: v1.2.6 to v1.28.2 (v1.28.3 is outside it) - CVE-2026-22689: v1.2.6 to v1.28.1 (v1.28.2 is outside it) - CVE-2026-21859: v1.2.6 to v1.28.0 (v1.28.1 is outside it) ## Advisories (15) ### [CVE-2026-67448](https://cve.now/CVE-2026-67448): Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) - Severity: Medium 6.5 - Published: Aug 20, 2026 - Affected: from 1.29.0, fixed in 1.30.6. - Fixed in v1.30.6 (released Jul 28, 2026, 23 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-67447](https://cve.now/CVE-2026-67447): Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement - Severity: Medium 5.3 - Published: Aug 20, 2026 - Affected: from 1.30.0, fixed in 1.30.5. - Fixed in v1.30.5 (released Jul 20, 2026, 31 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-67445](https://cve.now/CVE-2026-67445): Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection - Severity: Medium 5.3 - Published: Aug 20, 2026 - Affected: fixed in 1.30.4. - Fixed in v1.30.4 (released Jul 9, 2026, 42 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-67446](https://cve.now/CVE-2026-67446): Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling - Severity: Medium 5.3 - Published: Aug 20, 2026 - Affected: fixed in 1.30.4. - Fixed in v1.30.4 (released Jul 9, 2026, 42 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-48824](https://cve.now/CVE-2026-48824): Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and… - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 1.30.1. - Fixed in v1.30.1 (released May 28, 2026, 53 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-45713](https://cve.now/CVE-2026-45713): Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes - Severity: High 7.5 - Published: Jul 20, 2026 - Affected: fixed in 1.30.0. - Fixed in v1.30.0 (released May 14, 2026, 67 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-45712](https://cve.now/CVE-2026-45712): Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write) - Severity: Medium 5.9 - Published: Jul 20, 2026 - Affected: fixed in 1.30.0. - Fixed in v1.30.0 (released May 14, 2026, 67 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-45711](https://cve.now/CVE-2026-45711): Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs - Severity: Medium 5.9 - Published: Jul 20, 2026 - Affected: fixed in 1.30.0. - Fixed in v1.30.0 (released May 14, 2026, 67 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-45709](https://cve.now/CVE-2026-45709): Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer - Severity: Medium 5.8 - Published: Jul 20, 2026 - Affected: from 1.28.3, fixed in 1.30.0. - Fixed in v1.30.0 (released May 14, 2026, 67 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-55187](https://cve.now/CVE-2026-55187): Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) - Severity: Medium 5.8 - Published: Jul 10, 2026 - Affected: fixed in 1.30.2. - Fixed in v1.30.2 (released Jun 17, 2026, 23 days before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-27808](https://cve.now/CVE-2026-27808): Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API - Severity: Medium 5.8 - Published: Feb 25, 2026 - Affected: fixed in 1.29.2. - Fixed in v1.29.2 (released Feb 24, 2026, 1 day before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-23845](https://cve.now/CVE-2026-23845): Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API - Severity: Medium 5.8 - Published: Jan 19, 2026 - Affected: fixed in 1.28.3. - Fixed in v1.28.3 (released Jan 18, 2026, 1 day before disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-23829](https://cve.now/CVE-2026-23829): Mailpit has SMTP Header Injection via Regex Bypass - Severity: Medium 5.3 - Published: Jan 18, 2026 - Affected: fixed in 1.28.3. - Fixed in v1.28.3 (released Jan 18, 2026, the day of disclosure). - The latest release, v1.33.1, is not affected. ### [CVE-2026-22689](https://cve.now/CVE-2026-22689): Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails - Severity: Medium 6.5 - Published: Jan 10, 2026 - Affected: from 1.2.6, fixed in 1.28.2; fixed in 0.0.0-20260110031614. - Fixed in v1.28.2 (released Jan 10, 2026, the day of disclosure, the advisory names 0.0.0-20260110031614, which was never published). - The latest release, v1.33.1, is not affected. ### [CVE-2026-21859](https://cve.now/CVE-2026-21859): Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF) - Severity: Medium 5.8 - Published: Jan 7, 2026 - Affected: fixed in 1.28.1. - Fixed in v1.28.1 (released Jan 6, 2026, 1 day before disclosure). - The latest release, v1.33.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/axllent/mailpit Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.