Mailpit Unauthenticated Remote Memory Exhaustion Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Mailpit, an email testing tool for developers, in versions prior to 1.30.1. The issue arises in four JSON-body API endpoints: 'PUT /api/v1/messages', 'DELETE /api/v1/messages', 'PUT /api/v1/tags', and 'POST /api/v1/message/{id}/release'. These endpoints, which remain unauthenticated in the default Docker deployment, allow remote attackers to send large payloads that exhaust server memory. This vulnerability was introduced because the endpoints do not have a body-size limit, unlike the 'POST /api/v1/send' endpoint, which was properly capped. As a result, an attacker can drive the server's resident set size (RSS) from a baseline of approximately 25 MiB to around 450 MiB per 16 MB request, with the memory exhaustion compounding across multiple connections.

Impact

Exploitation of this vulnerability leads to pre-authentication remote memory exhaustion, causing the application to consume excessive memory and potentially terminate the process. This behavior is similar to the impact of CVE-2026-45710, the original vulnerability that this issue builds upon.

Reproduction

The vulnerability can be reproduced by sending a 'PUT' request to the '/api/v1/messages' endpoint with a large JSON body containing a multi-million-element 'IDs' slice. This can be done using a Python script that establishes a socket connection to the server, sends the request headers, and then streams the payload in chunks. The same amplification effect can be achieved with the other vulnerable endpoints: 'DELETE /api/v1/messages', 'PUT /api/v1/tags', and 'POST /api/v1/message/{id}/release', using identical body structures.

Remediation

Users can upgrade to Mailpit version 1.30.1, which patches the vulnerability by applying a body-size limit to all JSON API endpoints.