Riskcovery

CVE-2026-23829

Mailpit has SMTP Header Injection via Regex Bypass

State
Published
Severity
5.3 Medium
Published
Jan 18, 2026
Updated
Jan 20, 2026
Reserved
Jan 16, 2026

Read the record on cve.org

Description

Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NGitHub_M

Weaknesses

  • CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences

Affected Products

ProductVersions
mailpitaxllent
  • < 1.28.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.