Mailpit’s screenshot/print proxy (/proxy?data=…) maintains a package‑level cache of MessageAssets accessed by a map. Reads of this map are performed without acquiring the assetsMutex, while a background cleanup goroutine and a CSS‑rewriting code path acquire the same lock to write. When an unsynchronized read occurs simultaneously with a write, Go’s runtime throws a fatal error: "concurrent map read and map write", terminating the entire Mailpit process. The crash brings down SMTP, POP3, and HTTP listeners, leading to a denial of service for all Mailpit components. This flaw is a concurrency defect (CWE‑362) linked to improper resource allocation (CWE‑770) and requires no authentication to trigger.

The issue affects all installations of axllent Mailpit running versions prior to 1.30.0. The patch was introduced in the 1.30.0 release, so any running instance of Mailpit before that release is at risk.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated HTTP request to the /proxy?data=… endpoint, which triggers the CSS rewriter path concurrently with a cleanup goroutine. Because the crash is unrecoverable, an attacker can repeatedly cause service downtime without needing elevated privileges.