CVE-2026-45712: Mailpit Race Condition Vulnerability

CVE-2026-45712 Overview

CVE-2026-45712 is a concurrency flaw in Mailpit, an email testing tool and API for developers. Versions prior to 1.30.0 contain a race condition in the screenshot/print proxy endpoint (/proxy?data=…). The handler reads a package-level assets map[string]MessageAssets cache without holding assetsMutex, while a cleanup goroutine and a CSS-rewriting code path concurrently write to it under lock. When an unsynchronized read collides with a synchronized write, the Go runtime raises a fatal concurrent map read and map write error. This runtime.throw is not recoverable by http.Server's handler-panic recover, causing the entire Mailpit process to exit. The SMTP, POP3, and HTTP listeners all terminate. Version 1.30.0 contains the patch.

Critical Impact
A remote unauthenticated attacker can trigger a fatal runtime error by sending crafted requests to the proxy endpoint, terminating the Mailpit process and disrupting SMTP, POP3, and HTTP email testing services.

Affected Products

Mailpit versions prior to 1.30.0
Mailpit SMTP listener component
Mailpit POP3 and HTTP listener components

Discovery Timeline

2026-07-20 - CVE-2026-45712 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in the NVD database

Technical Details for CVE-2026-45712

Vulnerability Analysis

CVE-2026-45712 is a race condition vulnerability [CWE-362] affecting the Mailpit screenshot/print proxy handler. The /proxy?data=… endpoint accesses a package-level assets cache of type map[string]MessageAssets without acquiring assetsMutex. Concurrent code paths, including a long-running cleanup goroutine and a re-entrant CSS-rewriting routine, write to the same map while holding the lock. Go's runtime enforces safe concurrent map access at the runtime level. When it detects a simultaneous read and write, it raises fatal error: concurrent map read and map write. Unlike a standard panic, this is a runtime.throw that bypasses http.Server's built-in per-handler panic recovery mechanism. The result is process termination rather than a failed HTTP request.

Root Cause

The root cause is inconsistent synchronization on a shared data structure. Write paths acquire assetsMutex correctly, but at least one read path in the proxy handler omits the lock acquisition. This partial locking pattern creates a race window whenever the proxy handler executes concurrently with a cleanup or CSS-rewriting operation.

Attack Vector

A remote attacker sends requests to the /proxy?data=… endpoint while the cleanup goroutine or CSS-rewriting path is active. No authentication or user interaction is required. The attack succeeds probabilistically based on timing between the reader and writer. Repeated requests increase the likelihood of collision. When the race triggers, all Mailpit listeners terminate, denying service to SMTP submission, POP3 retrieval, and the HTTP web UI.

No public proof-of-concept code is available. See the GitHub Security Advisory GHSA-w4vj-r5pg-3722 for additional technical details.

Detection Methods for CVE-2026-45712

Indicators of Compromise

Unexpected Mailpit process termination with a stack trace containing fatal error: concurrent map read and map write
Sudden loss of SMTP, POP3, and HTTP listeners without a clean shutdown log entry
Elevated request volume against the /proxy?data=… endpoint prior to a crash

Detection Strategies

Monitor Mailpit stderr and container logs for runtime.throw messages and Go runtime fatal error stack traces
Alert on Mailpit service restarts or process exits correlated with proxy endpoint traffic
Inspect HTTP access logs for repeated or high-frequency requests to /proxy from single source addresses

Monitoring Recommendations

Configure process supervision (systemd, Docker healthchecks, Kubernetes liveness probes) to detect and report Mailpit exits
Forward Mailpit application logs to a centralized logging pipeline with alerting on fatal Go runtime errors
Track version metadata across Mailpit deployments to identify hosts still running versions prior to 1.30.0

How to Mitigate CVE-2026-45712

Immediate Actions Required

Upgrade all Mailpit instances to version 1.30.0 or later, which contains the synchronization fix
Restrict network exposure of the Mailpit HTTP interface to trusted developer networks or authenticated reverse proxies
Audit deployments to confirm Mailpit is not exposed to untrusted networks or the public internet

Patch Information

The fix is included in Mailpit 1.30.0. The release notes are available on the GitHub Mailpit Release Notes page. Upgrade using the standard distribution mechanism (binary download, Docker image, or package manager) and restart the service.

Workarounds

Place Mailpit behind a reverse proxy that blocks or rate-limits requests to the /proxy path until the upgrade is applied
Bind Mailpit listeners to loopback interfaces where remote access is not required
Configure a process manager to automatically restart Mailpit on exit to reduce downtime while the patch is scheduled

bash

# Example: upgrade Mailpit via Docker to the patched release
docker pull axllent/mailpit:v1.30.0
docker stop mailpit && docker rm mailpit
docker run -d --name mailpit \
  -p 127.0.0.1:8025:8025 \
  -p 127.0.0.1:1025:1025 \
  axllent/mailpit:v1.30.0