Mailpit is an email testing tool that generates thumbnails by first decoding the entire image before applying size constraints. This flaw allows an attacker to supply an image whose declared dimensions are far larger than the actual pixel data, causing the decoding process to allocate an enormous amount of memory and CPU time. If the image is processed, the server may consume excessive resources, potentially leading to a denial of service for legitimate users.

The vulnerability affects all installations of axllent Mailpit older than version 1.30.4. Users running a pre‑1.30.4 release must upgrade to the patched 1.30.4 or later release.

The CVSS score of 5.3 indicates moderate severity. Exploitation requires the ability to upload an image attachment or otherwise trigger the thumbnail endpoint, which is available without authentication. The EPSS score is not available, and the issue is not currently listed in CISA's KEV catalog. The likely attack vector is the thumbnail generation endpoint; an attacker can craft a message with an oversized attachment, upload it, and then request its thumbnail to exhaust server memory or CPU, resulting in degraded availability. The risk is moderate but could be amplified by the lack of authentication on the vulnerable path.