Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/axllent/mailpit | go | <= 1.30.3 | 1.30.4 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-67445, stems from Mailpit's SMTP and POP3 command parsers buffering unbounded command lines. Specifically, the bufio.Reader.ReadString method was used without a size limit, allowing an attacker to send an arbitrarily long line without a newline character, causing the server to allocate excessive memory. The provided commit 993bed95b3c74d95231af93bd0e0d4c3d5b4db4d addresses this by replacing bufio.NewReader with bufio.NewReaderSize and bufio.Reader.ReadString with bufio.Reader.ReadLine, which allows checking for isPrefix to detect and reject oversized lines.
In internal/smtpd/smtpd.go, the session.readLine function directly used s.br.ReadString('\n'), which is the core of the unbounded read. The (*Server).newSession and (*session).handleTLS functions are vulnerable because they instantiated the bufio.Reader using bufio.NewReader(conn) (or s.conn), which creates a reader without a predefined size limit, thus enabling the unbounded buffering in readLine.
Similarly, in internal/pop3/server.go, the handleClient function directly initialized the bufio.Reader without a size limit and then used reader.ReadString('\n') to process client input, making it susceptible to the same memory exhaustion attack.
These functions would appear in a runtime profile when an attacker sends an oversized command, as they are directly involved in reading and buffering the malicious input before any length checks are applied.
github.com/axllent/mailpit/internal/smtpd.(*session).readLineinternal/smtpd/smtpd.go
github.com/axllent/mailpit/internal/smtpd.(*Server).newSessioninternal/smtpd/smtpd.go
github.com/axllent/mailpit/internal/smtpd.(*session).handleTLSinternal/smtpd/smtpd.go
github.com/axllent/mailpit/internal/pop3.handleClientinternal/pop3/server.go