Mailpit, a mail testing tool, reads SMTP commands by buffering the entire line before rejecting oversized commands. The parser uses bufio.Reader.ReadString without enforcing the RFC 5321 512‑octet limit, allowing a remote SMTP client to send a command line that is fully allocated in memory before syntax rejection or timeout, potentially exhausting heap space. This behavior constitutes a resource exhaustion flaw identified as CWE-400.

The CVE affects axllent Mailpit versions prior to 1.30.4. Users of Mailpit running any earlier version should upgrade to 1.30.4 or later; no other vendors or products are listed as affected.

With a CVSS score of 5.3 the vulnerability is considered medium severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. An unauthenticated remote SMTP client can initiate the exploit by sending an oversized command before authentication, and concurrent connections can amplify memory pressure to deny service. The problem exists in the normal command parsing path as well as in AUTH continuation handling, so a single attacker can degrade service availability without needing any credentials.