https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:28:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266130 EUVD-2026-266130 https://cve.radiocsirt.org/vuln/euvd-2026-266130 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23829 <p>Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit&#39;s SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.</p> <p>Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit&#39;s SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23829 https://cve.radiocsirt.org/vuln/ghsa-54wq-72mp-cq7c <p><strong>Affected:</strong> Go: github.com/axllent/mailpit</p> <p># Vulnerability Report: SMTP Header Injection via Regex Bypass</p> <p>**Vulnerable Code:** `mailpit/internal/smtpd/smtpd.go`</p> <p>## Executive Summary Mailpit&#39;s SMTP server is vulnerable to **Header Injection** due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class.</p> <p>## RFC Compliance &amp; Design Analysis **&#34;Is this behavior intentional for a testing tool?&#34;** No. While testing tools are often permissive, this specific behavior violates the core SMTP protocol and fails the developer&#39;s own intent.</p> <p>1. **RFC 5321 Violation:** The SMTP protocol strictly forbids Control Characters (CR, LF, Null) in the envelope address (`Mailbox`). * *RFC 5321 Section 4.1.2:* A `Mailbox` consists of an `Atom` or `Quoted-string`. An `Atom` explicitly excludes &#34;specials, SPACE and CTLs&#34; (Control Characters). 2. **Failed Intent:** The existence of `\v` in the regex `[^&lt;&gt;\v]` proves the developer **intended** to block vertical whitespace. The vulnerability is that `\v` in Go regex (`re2`) inside brackets `[]` matches *only* Vertical Tab, not CR/LF. If the design were to allow everything, the `\v` exclusion wouldn&#39;t exist. 3. **Data Corruption:** Allowing `\r` results in the ge…</p> <p><strong>Affected:</strong> Go: github.com/axllent/mailpit</p> <p># Vulnerability Report: SMTP Header Injection via Regex Bypass</p> <p>**Vulnerable Code:** `mailpit/internal/smtpd/smtpd.go`</p> <p>## Executive Summary Mailpit&#39;s SMTP server is vulnerable to **Header Injection** due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class.</p> <p>## RFC Compliance &amp; Design Analysis **&#34;Is this behavior intentional for a testing tool?&#34;** No. While testing tools are often permissive, this specific behavior violates the core SMTP protocol and fails the developer&#39;s own intent.</p> <p>1. **RFC 5321 Violation:** The SMTP protocol strictly forbids Control Characters (CR, LF, Null) in the envelope address (`Mailbox`). * *RFC 5321 Section 4.1.2:* A `Mailbox` consists of an `Atom` or `Quoted-string`. An `Atom` explicitly excludes &#34;specials, SPACE and CTLs&#34; (Control Characters). 2. **Failed Intent:** The existence of `\v` in the regex `[^&lt;&gt;\v]` proves the developer **intended** to block vertical whitespace. The vulnerability is that `\v` in Go regex (`re2`) inside brackets `[]` matches *only* Vertical Tab, not CR/LF. If the design were to allow everything, the `\v` exclusion wouldn&#39;t exist. 3. **Data Corruption:** Allowing `\r` results in the ge…</p> https://cve.radiocsirt.org/vuln/ghsa-54wq-72mp-cq7c https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0146 <p>Ein Angreifer kann mehrere Schwachstellen in MailPit ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MailPit ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0146