CVE-2026-48824: Mailpit DoS Vulnerability

CVE-2026-48824 Overview

CVE-2026-48824 affects Mailpit, an email testing tool and API for developers. Versions prior to 1.30.1 fail to apply body-size limits on four JSON API endpoints, allowing an unauthenticated remote attacker to exhaust memory. The earlier fix for CVE-2026-45710 wrapped only POST /api/v1/send with http.MaxBytesReader, leaving PUT /api/v1/messages, DELETE /api/v1/messages, PUT /api/v1/tags, and POST /api/v1/message/{id}/release uncapped. These endpoints remain reachable without authentication in the default docker run axllent/mailpit:latest deployment. A single 16 MB request body containing a multi-million-element IDs slice can drive resident memory from a 25 MiB baseline to approximately 450 MiB per process.

Critical Impact
An unauthenticated remote attacker can trigger memory exhaustion by sending large JSON payloads to four uncapped Mailpit API endpoints, causing denial of service against the default deployment.

Affected Products

Mailpit versions prior to 1.30.1
Default axllent/mailpit:latest Docker deployments
Any Mailpit instance exposing the HTTP API without a reverse-proxy body-size limit

Discovery Timeline

2026-07-20 - CVE-2026-48824 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-48824

Vulnerability Analysis

The vulnerability is an uncontrolled resource consumption flaw classified under [CWE-770]. Mailpit's HTTP handlers for four JSON API endpoints invoke json.NewDecoder(r.Body) directly against the raw request body. No wrapper enforces a maximum byte cap, so the decoder streams whatever the client sends.

The prior remediation for CVE-2026-45710 applied http.MaxBytesReader only to POST /api/v1/send. The four handlers affected here, SetReadStatus, DeleteMessages, SetMessageTags, and ReleaseMessage, were not covered. Each accepts a JSON object containing an IDs slice.

An attacker who submits a 16 MB body encoding millions of short string elements forces Go's runtime to allocate large backing arrays and per-element string headers. Measured resident set size grows from roughly 25 MiB baseline to approximately 450 MiB per request. Concurrent connections multiply the amplification per process until the host runs out of memory.

Root Cause

The root cause is missing input-size validation. Handlers deserialize attacker-controlled JSON without bounding the number of decoded elements or the raw byte count. The default Mailpit container also exposes these endpoints unauthenticated on port 8025.

Attack Vector

The attack is remote, unauthenticated, and network-based. An attacker sends HTTP requests such as PUT /api/v1/messages with a large JSON body containing an oversized IDs array. Repeating requests across parallel connections compounds memory pressure until the Mailpit process is killed or the host becomes unresponsive. Refer to the GitHub Security Advisory GHSA-28pq-6qxg-wg5r for full technical detail.

Detection Methods for CVE-2026-48824

Indicators of Compromise

HTTP PUT or DELETE requests to /api/v1/messages, /api/v1/tags, or /api/v1/message/{id}/release with Content-Length values approaching 16 MB
Sudden Mailpit process RSS growth from a ~25 MiB baseline toward several hundred MiB
Repeated OOM-kill events or container restarts on hosts running axllent/mailpit

Detection Strategies

Alert on any unauthenticated JSON POST/PUT/DELETE to Mailpit API endpoints exceeding a defined body size threshold, for example 1 MB
Monitor process memory metrics for the Mailpit binary and trigger on rapid growth per request
Inspect reverse-proxy access logs for high-volume requests to the four affected endpoints from a single source

Monitoring Recommendations

Ingest Mailpit container logs and host memory telemetry into a centralized analytics platform for correlation
Track HTTP request-size distributions per endpoint and alert on outliers
Monitor container restart counts and Linux OOM-killer events on hosts running Mailpit

How to Mitigate CVE-2026-48824

Immediate Actions Required

Upgrade Mailpit to version 1.30.1 or later using the release published at GitHub Mailpit Release v1.30.1
Restrict network access to the Mailpit HTTP API so only trusted developer networks can reach it
Place Mailpit behind a reverse proxy that enforces a request-body size limit

Patch Information

Mailpit version 1.30.1 contains the fix. The patched release wraps the four previously uncapped handlers with http.MaxBytesReader, enforcing the same 50 MB default limit already applied to POST /api/v1/send. Review the GitHub Security Advisory GHSA-28pq-6qxg-wg5r for advisory details.

Workarounds

Front Mailpit with Nginx, Traefik, or a similar proxy that caps client_max_body_size at a low value such as 1 MB
Require authentication on the Mailpit UI and API using the built-in basic-auth flags
Isolate Mailpit containers on internal networks and block ingress from the public internet

bash

# Nginx reverse-proxy example limiting Mailpit request bodies
server {
    listen 8025;
    client_max_body_size 1m;

    location / {
        proxy_pass http://127.0.0.1:8125;
        proxy_set_header Host $host;
    }
}