diff options
| author | Guido Falsi <madpilot@FreeBSD.org> | 2026-07-20 06:53:36 +0000 |
|---|---|---|
| committer | Guido Falsi <madpilot@FreeBSD.org> | 2026-07-20 06:53:36 +0000 |
| commit | 8a2d477f41e12be583b443ce2097532ad2ae1406 (patch) | |
| tree | 48d3ed467f5e6b7b321634900a90c068bce0e41a | |
| parent | 6d99a569fc5f92410614c124a0a3ccfd4a5644ea (diff) | |
| -rw-r--r-- | security/vuxml/vuln/2026.xml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml index b7cf45cd5adb..7766cab4e8cb 100644 --- a/security/vuxml/vuln/2026.xml +++ b/security/vuxml/vuln/2026.xml @@ -1,3 +1,36 @@ + <vuln vid="562ff91e-8407-11f1-bfde-10ffe07f9334"> + <topic>Mailpit -- SMTP DATA line reader buffers over-limit input before size enforcement</topic> + <affects> + <package> + <name>mailpit</name> + <range><lt>1.30.5</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Mailpit author reports:</p> + <blockquote cite="https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97"> + <p>Mailpit's SMTP DATA reader enforces the configured + MaxMessageSize only after bufio.Reader.ReadBytes('\n') + has already buffered a complete DATA line. A remote + unauthenticated SMTP client can send one line larger than + the configured message-size cap and force memory allocation + before Mailpit returns the expected 552 5.3.4 rejection, + leaving patched versions still exposed to a single-line + incomplete-fix variant of the earlier SMTP DATA body-size + issue.</p> + </blockquote> + </body> + </description> + <references> + <url>https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97</url> + </references> + <dates> + <discovery>2026-07-20</discovery> + <entry>2026-07-20</entry> + </dates> + </vuln> + <vuln vid="272a2772-8367-11f1-82b9-901b0e9408dc"> <topic>tailscale -- Multiple vulnerabilities</topic> <affects> |