mailpit
v1.33.1An email and SMTP testing tool with API for developers
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- MITPermissive · OSI-approved
- Security
- 17 advisories1 high, 16 medium
- Supported versions
- No scheduleendoflife.date does not track this project
10.9k stars · 379 forks · 0 open issues · last release 7 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 17 most recent advisories published by the maintainers: 1 high, 16 medium. Check the patched version against the one you run.
- highGHSA-379p-g4f4-hq5hOct 22, 2026Unbounded CPU and memory consumption in thumbnail endpoint via cyclic EXIF IFD chain
- Affected
- <= 1.31.6
- Patched in
- 1.32.0
- mediumGHSA-2vgv-6hcp-mf43Sep 19, 2026Multi-frame animation bypass of thumbnail pixel budget (follow-up to GHSA-75mr-qw9x-3r39)
- Affected
- >= 1.30.4, <= 1.31.1
- Patched in
- 1.31.2
- mediumCVE-2026-67448Jul 28, 2026WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
- Affected
- <= 1.30.5
- Patched in
- 1.30.6
- mediumCVE-2026-67447Jul 20, 2026SMTP DATA line reader buffers over-limit input before size enforcement
- Affected
- >= 1.30.0
- Patched in
- 1.30.5
- mediumCVE-2026-67445Jul 9, 2026SMTP command parser buffers unbounded command lines before syntax rejection
- Affected
- <= 1.30.3
- Patched in
- 1.30.4
- mediumCVE-2026-67446Jul 9, 2026Thumbnail generation decodes unbounded image dimensions before scaling
- Affected
- <= 1.30.3
- Patched in
- 1.30.4
- mediumCVE-2026-55187Jun 17, 2026Incomplete SSRF protection in Link Check API via uncovered IPv6 forms (follow-up to GHSA-mpf7-p9x7-96r3 / CVE-2026-27808)
- Affected
- <= 1.30.1
- Patched in
- 1.30.2
- mediumCVE-2026-48824May 28, 2026Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)
- Affected
- <= 1.30.0
- Patched in
- 1.30.1
- mediumCVE-2026-45709May 14, 2026Incomplete fix for GHSA-6jxm-fv7w-rw5j: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer
- Affected
- >= 1.28.3
- Patched in
- 1.30.0
- mediumCVE-2026-45711May 14, 2026Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs
- Affected
- < 1.29.8
- Patched in
- 1.30.0
- mediumCVE-2026-45712May 14, 2026Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)
- Affected
- < 1.29.8
- Patched in
- 1.30.0
- mediumCVE-2026-45713May 14, 2026Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
- Affected
- < 1.29.8
- Patched in
- 1.30.0
- mediumCVE-2026-27808Feb 24, 2026Server-Side Request Forgery (SSRF) via Link Check API
- Affected
- <= 1.29.1
- Patched in
- 1.29.2
- mediumCVE-2026-23845Jan 18, 2026Server-Side Request Forgery (SSRF) via HTML Check API
- Affected
- <= 1.28.2; < 0.0.0-20260117230009
- Patched in
- 1.28.3; 0.0.0-20260117230009
- mediumCVE-2026-23829Jan 17, 2026SMTP Header Injection via Regex Bypass
- Affected
- <= 1.28.2; < 0.0.0-20260117230009
- Patched in
- 1.28.3; 0.0.0-20260117230009
- mediumCVE-2026-22689Jan 9, 2026Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to message data
- Affected
- <=1.28.1; < 0.0.0-20260110031614
- Patched in
- 1.28.2; 0.0.0-20260110031614
- mediumCVE-2026-21859Jan 6, 2026Server-Side Request Forgery (SSRF) in Mailpit Proxy Endpoint
- Affected
- <= 1.28.0; < 0.0.0-20260108032324
- Patched in
- 1.28.1; 0.0.0-20260108032324