CVE-2026-23829
Medium · 5.3CVSS
5.3
EPSS
1.4%
Published
Jan 19, 2026
CISA due date
—
The record
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/axllent/mailpit | 0 | 1.28.3 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- GO-2026-4333 Mailpit has an SMTP Header Injection via Regex Bypass in github.com/axllent/mailpit Same vulnerability
- GHSA-mpf7-p9x7-96r3 Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API Also affects github.com/axllent/mailpit
- CVE-2026-27808 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit
- GO-2026-4345 Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API in… Also affects github.com/axllent/mailpit
- GO-2026-4310 Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated… Also affects github.com/axllent/mailpit
- CVE-2026-23845 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit
- GO-2026-4284 Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability in… Also affects github.com/axllent/mailpit
- CVE-2026-22689 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit