Mailpit, an email testing tool, had a flaw where the SMTP DATA line reader accepted input beyond the configured maximum before enforcing size limits, causing a large buffer to be allocated. An unauthenticated client could send a single line larger than the server’s MaxMessageSize, leading the server to allocate memory for the entire line before rejecting the message. This can create excessive memory pressure and potentially allow a denial‑of‑service attack. The weakness is classified as CWE-770, an improper restriction on resources.

The issue affects axllent Mailpit versions 1.30.0 through 1.30.5. Affected users are running any instance of Mailpit within that version range without the patch. Later releases, starting with 1.30.6, contain the fix.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and it is not listed in the CISA KEV catalog, suggesting the threat is not widely exploited yet. The attack vector is network‑based; any SMTP client that can reach the Mailpit server can exploit the flaw without authentication, making the risk readily actionable by attackers who discover exposed instances.