Mailpit is an email testing tool and API for developers. Prior to version 1.30.0 its SMTP server allowed unlimited DATA payloads because the Server.MaxSize field was left at the zero value, and the HTTP /api/v1/send endpoint decoded JSON bodies without a size limit. This represents a classic resource‑exhaustion flaw (CWE‑400) and a lack of bounds checking (CWE‑770), giving an attacker the ability to overload the application’s memory. The service binds openly on IPv6 [::]:1025 for SMTP and [::]:8025 for HTTP without authentication, so any machine that can reach those ports can initiate the attack. Each large message is expanded through several layers—raw frame to an enmime envelope tree, a search‑text index, and a ZSTD‑encoded SQLite write—causing memory usage to grow roughly 7‑10 times the payload size and ultimately leading to an out‑of‑memory kill of the process.

All versions of Mailpit by vendor axllent prior to 1.30.0 are vulnerable. The default SMTP listener keeps the Server.MaxSize field at its zero value, and the HTTP endpoint decodes bodies without a size limit. The service binds openly on IPv6 [::]:1025 for SMTP and [::]:8025 for HTTP on both interfaces, so any machine that can reach those ports can exercise the flaw.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. However, because the service requires no authentication and accepts arbitrarily large payloads, an attacker with network access to the default ports can send large messages repeatedly or concurrently, rapidly consuming RAM and causing the process to be terminated by the operating system.