Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a memory exhaustion denial-of-service in Mailpit versions up to and including 1.30.0. A previous security fix for a similar issue was incomplete, protecting only the /api/v1/send endpoint. This left four other API endpoints that process JSON data vulnerable: PUT /api/v1/messages, DELETE /api/v1/messages, PUT /api/v1/tags, and POST /api/v1/message/{id}/release. These endpoints are handled by the functions SetReadStatus, DeleteMessages, SetMessageTags, and ReleaseMessage, respectively. These functions would decode the JSON from the request body without enforcing any size limits. An unauthenticated attacker could exploit this by sending a request with a very large JSON body, such as a JSON object with a multi-million-element array. This would cause the application to consume an excessive amount of memory, ultimately leading to a denial-of-service condition. The vulnerability was patched in version 1.30.1 by implementing a default request body size limit within a central middleware (middleWareFunc), effectively protecting all the vulnerable endpoints.
SetReadStatusserver/apiv1/messages.go
DeleteMessagesserver/apiv1/messages.go
SetMessageTagsserver/apiv1/tags.go
ReleaseMessageserver/apiv1/release.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/axllent/mailpit | go | <= 1.30.0 | 1.30.1 |