Most recent entries from all

EUVD-2026-266130

2026-10-06T13:34:02.220871+00:00

EUVD-2026-266130

fkie_cve-2026-23829

2026-10-06T13:34:02.220909+00:00

Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.

GHSA-54wq-72mp-cq7c — Mailpit has an SMTP Header Injection via Regex Bypass

2026-10-06T13:34:02.220945+00:00

Affected: Go: github.com/axllent/mailpit

# Vulnerability Report: SMTP Header Injection via Regex Bypass

**Vulnerable Code:** `mailpit/internal/smtpd/smtpd.go`

## Executive Summary Mailpit's SMTP server is vulnerable to **Header Injection** due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class.

## RFC Compliance & Design Analysis **"Is this behavior intentional for a testing tool?"** No. While testing tools are often permissive, this specific behavior violates the core SMTP protocol and fails the developer's own intent.

1. **RFC 5321 Violation:** The SMTP protocol strictly forbids Control Characters (CR, LF, Null) in the envelope address (`Mailbox`). * *RFC 5321 Section 4.1.2:* A `Mailbox` consists of an `Atom` or `Quoted-string`. An `Atom` explicitly excludes "specials, SPACE and CTLs" (Control Characters). 2. **Failed Intent:** The existence of `\v` in the regex `[^<>\v]` proves the developer **intended** to block vertical whitespace. The vulnerability is that `\v` in Go regex (`re2`) inside brackets `[]` matches *only* Vertical Tab, not CR/LF. If the design were to allow everything, the `\v` exclusion wouldn't exist. 3. **Data Corruption:** Allowing `\r` results in the ge…

WID-SEC-W-2026-0146 — MailPit: Mehrere Schwachstellen

2026-10-06T13:34:02.221012+00:00

Ein Angreifer kann mehrere Schwachstellen in MailPit ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.