{"id":"CVE-2026-67446","title":"Mailpit is an email testing tool and API for developers","summary":"Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{i…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-400","CWE-770"],"vendor":"axllent","product":"github.com/axllent/mailpit","affected":["github.com/axllent/mailpit < 1.30.4"],"patched":["github.com/axllent/mailpit 1.30.4"],"published":"2026-08-20","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67446","references":[{"url":"https://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35","label":"security-advisories@github.com"},{"url":"https://github.com/axllent/mailpit/releases/tag/v1.30.4","label":"security-advisories@github.com"},{"url":"https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39","label":"security-advisories@github.com"},{"url":"https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67446"},{"url":"https://github.com/axllent/mailpit"},{"url":"https://github.com/advisories/GHSA-75mr-qw9x-3r39"}],"tags":["nvd","osv","go","ghsa","score-dispute"],"epss":0.00371,"epssPercentile":0.30883,"aliases":["GHSA-75mr-qw9x-3r39","GO-2026-6359"],"ecosystem":"go","scores":{"nvd":5.3,"osv":7.5},"ingestedAt":"2026-09-02T23:52:23.098Z","slug":"CVE-2026-67446","body":"## Overview\n\nMailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-67446)\n\nAffected packages:\n\n- `github.com/axllent/mailpit < 1.30.4`\n\nPatched in:\n\n- `github.com/axllent/mailpit 1.30.4`\n\nSource: https://osv.dev/vulnerability/GHSA-75mr-qw9x-3r39","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":207496,"id":"CVE-2026-67446","ts":1789764752700,"field":"cvss","old":"7.5","new":"5.3"},{"seq":207495,"id":"CVE-2026-67446","ts":1789764752700,"field":"severity","old":"high","new":"medium"}]}