Mailpit’s /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release endpoints process unbounded JSON bodies without size limits. An attacker can submit a request containing a multi‑million‑element array of IDs, causing the server to consume memory far beyond the normal 25 MiB baseline and potentially exhausting system resources. This condition leads to a denial‑of‑service that degrades or stops Mailpit’s functionality for legitimate users. The weakness is identified as CWE‑770.

The vulnerability affects the Mailpit email testing and API tool developed by axllent. Any deployment using Mailpit version 1.30.0 or earlier remains vulnerable because the default Docker image exposes these endpoints without authentication. The fix is included in version 1.30.1 and later; all earlier releases are impacted.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of < 1% suggests a low exploitation probability. Mailpit’s default Docker configuration allows unauthenticated access to the vulnerable endpoints, making the attack vector remote and straightforward to reach. Since the vulnerability is not listed in CISA’s KEV catalog, there is no evidence of known widespread exploitation, but the lack of a request‑size limit means a determined attacker can easily trigger the DoS condition once they discover the endpoints.