THREAT OPS › Threat News › [GHSA] GHSA-w878-pj84-3j5v (high) — Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
[GHSA] GHSA-w878-pj84-3j5v (high) — Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
GHSA-w878-pj84-3j5v Severity: high CVE: CVE-2026-67445
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
## Summary
Mailpit's SMTP server reads each command line with an unbounded `bufio.Reader.ReadString('\n')` before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to
Indicators of compromise
- cd7661fd5b23cce1e218b583b21e157cfa612051sha1
- 6acf5b8f942ab0e007b1227d31dfb3c3303e8d13sha1
- CVE-2026-67445cve
- 4.5.3.1ipv4
Original source: https://github.com/advisories/GHSA-w878-pj84-3j5v