THREAT OPS › Threat News › [GHSA] GHSA-r553-m4fv-5v97 (medium) — Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
[GHSA] GHSA-r553-m4fv-5v97 (medium) — Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
GHSA-r553-m4fv-5v97 Severity: medium CVE: CVE-2026-67447
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
## Summary
Mailpit's SMTP DATA reader enforces the configured `MaxMessageSize` only after `bufio.Reader.ReadBytes('\n')` has already buffered a complete DATA line. A remote unauthenticated SMTP client can send one line larger than the configured message-size c
Indicators of compromise
- af8756a32cf7ecf06bef109c1348b783f1a239eesha1
- 6acf5b8f942ab0e007b1227d31dfb3c3303e8d13sha1
- 3b41030dbef4574ec92b815cb464fec7b4cfdc15sha1
- 6a09f28d5489a85245cc8ddbf512047495627147sha1
- CVE-2026-67447cve
- sender@example.testemail
- recipient@example.testemail
Original source: https://github.com/advisories/GHSA-r553-m4fv-5v97