mail/mailpit -- multiple vulnerabilities

2026-05-14 · CVE-2026-45713, CVE-2026-45709, CVE-2026-45711, CVE-2026-45712 · VuXML entry

Mailpit author reports: Set a default 50MB per message limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes (GHSA-fpxj-m5q8-fphw) Include CGNAT (Carrier-Grade NAT) in internal IP checks (GHSA-j3fj-qppj-fmmc) Block internal IP access by default in HTML check (GHSA-j3fj-qppj-fmmc) Fix for path traversal & arbitrary file write in mailpit dump --http <instance> via attacker-controlled message IDs …

Affected versions

• mailpit < 1.30.0

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.