CVE-2026-67447

CVE-2026-67447 in Mailpit demonstrates a gap between a developer's security intent and how Go's bufio.Reader actually allocates memory. The Server.MaxSize field exists, the 552 rejection message is correct, and the check was properly implemented — but it was placed after the bufio.Reader.ReadBytes call rather than before the memory allocation it triggers. The core failure is that ReadBytes blocks until it finds its delimiter, meaning the entire oversized line is already in memory when the size check executes. The developer modeled message size limiting as bounding total DATA phase bytes across multiple lines, not as protecting any single line's memory footprint. These are two different security models that happen to share a configuration field. This vulnerability survived an earlier fix to multi-line accumulation bounds, which is the critical context. The team correctly identified that unbounded DATA accumulation was dangerous and closed that path — but the same ReadBytes primitive remained exploitable through single-line reads because it operated under different assumptions. This is the pattern that should concern you: each partial fix can create false confidence in adjacent, unexamined code paths. The multi-line fix was a maintenance event that lulled the developer into believing the I/O pattern was secure, exactly when the single-line gap became invisible. The 552 rejection message compounds the issue — it correctly tells the client why their message was rejected while the actual security violation (memory consumption) has already occurred. That's not a misconfigured guard; it's a guard that performs its intended function while being architecturally incapable of preventing the harm it's supposed to stop. For threat modeling: Mailpit is a development tool often exposed in networked test environments via Docker, team VPNs, or misconfigured firewall rules. This is unauthenticated resource exhaustion against a developer's workstation — low CVSS score, but real impact in shared CI environments or cloud IDEs where a single oversized line per connection can stack memory pressure across concurrent connections until the workstation degrades. The CVSS 5.3 treats the target as an isolated system, not a node in an interconnected development topology where one compromised workstation cascades into corrupted test data and failed pipelines. The underlying issue — bufio.Reader operations that allocate before checking — is a documented Go Gotcha that has produced CVEs across multiple codebases independently. The fact that Mailpit landed in this same hole suggests the Go ecosystem hasn't built persistent institutional memory of this abstraction mismatch. Patch 1.30.5 addresses the reported path, but the question of whether it changes the I/O pattern throughout or patches only the singular reported path determines whether residual gaps remain.

Reviewed through automated stages and approved by a human before publication.