CVE-2026-23829
Mailpit has SMTP Header Injection via Regex Bypass
- Published
- Jan 18, 2026
- Updated
- Jan 20, 2026
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 25, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NLow · next 30 days
- Percentile
- 71.3%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.
Sources
2Exploit tool that transforms SMTP header injection into remote code execution with self-propagating worm capabilities, featuring persistence mechanisms and evasion techniques for authorized penetration testing.
It's a CRLF injection in Mailpit's SMTP server — a classic data corruption vulnerability. But under CTT, it's not just a bug. It's a phase reconstruction opportunity.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.