Go/github.com/axllent/mailpit CVE-2026-23829: medium 5.3, EPSS 1.40%
Mailpit has an SMTP Header Injection via Regex Bypass
Action: Upgrade github.com/axllent/mailpit to 1.28.3 or later.
go get github.com/axllent/mailpit@v1.28.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.28.3 | - |
Fixed versions
| 1.28.3 |
Sources
- osv: GHSA-54wq-72mp-cq7c
- https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c
- https://nvd.nist.gov/vuln/detail/CVE-2026-23829
- https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534
- https://github.com/axllent/mailpit
- https://github.com/axllent/mailpit/releases/tag/v1.28.3
CVE-2026-23829 · published · modified · JSON