Vulnerability · Published Jan 18, 2026 · Assigned by GitHub_M

CVE-2026-23829Mailpit has SMTP Header Injection via Regex Bypass

Medium 5.3

In plain English

A medium-severity security flaw in mailpit from axllent. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.4%top 27.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/axllent/mailpit	1.28.3	GHSA-54wq-72mp-cq7c
Go	github.com/axllent/mailpit	1.28.3	GO-2026-4333

Affected products (as reported)

Vendor	Product	Versions
axllent	mailpit	< 1.28.3

Weakness: CWE-93, CWE-150 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c x_refsource_CONFIRM
https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534 x_refsource_MISC
https://github.com/axllent/mailpit/releases/tag/v1.28.3 x_refsource_MISC