CVE-2026-23829: 
NixOS vulnerability analysis and mitigation

CVE-2026-23829 is an SMTP Header Injection vulnerability in Mailpit, an email testing tool and API for developers, caused by insufficient regular expression validation of RCPT TO and MAIL FROM addresses. All versions up to and including 1.28.2 are affected; version 1.28.3 resolves the issue. The vulnerability was disclosed via GitHub Advisory GHSA-54wq-72mp-cq7c on January 17, 2026, and published to the NVD on January 19, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Mailpit Advisory).

The root cause lies in a flawed regex character class used in internal/smtpd/smtpd.go to validate SMTP envelope addresses (CWE-93, CWE-150). The regexes rcptToRE and mailFromRE use [^<>\v] intending to block vertical whitespace, but in Go's RE2 engine, \v inside a character class matches only the Vertical Tab (\x0B), not Carriage Return (\r, 0x0D) or Line Feed (\n, 0x0A). As a result, an attacker can include \r in a crafted RCPT TO or MAIL FROM address, which passes validation and is then embedded directly into the Received header via buffer.WriteString(fmt.Sprintf(" for <%s>; %s\r\n", to[0], now)), producing a "Bare CR" that corrupts the stored .eml file and can trigger full header injection in downstream mail clients. A public PoC Python script demonstrating the bare CR injection is included in the advisory (Mailpit Advisory, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to inject arbitrary SMTP headers into emails processed by Mailpit, corrupting stored .eml files and potentially enabling email spoofing and phishing attacks. While the Mailpit UI may render the bare CR as a space (masking the injection), downstream systems such as Outlook or older MTAs may interpret it as a line break, triggering full header injection. The vulnerability has no direct confidentiality or availability impact, but integrity is compromised through header manipulation; additionally, developers using Mailpit may receive a false sense of security if their applications generate malformed emails that pass Mailpit's validation but fail in production environments (Mailpit Advisory).

Multiple proof-of-concept exploits are publicly available, including two GitHub repositories attributed to SimoesCTT and the PoC script embedded in the official advisory (Github Advisory). A Nuclei detection template has also been added to the ProjectDiscovery nuclei-templates repository, enabling automated scanning. The EPSS score is approximately 0.038% per Feedly data, though the GitHub Advisory Database reports 1.594% (82nd percentile). There is no evidence of active in-the-wild exploitation as of the time of reporting, and the vulnerability is not listed in the CISA KEV catalog (Mailpit Advisory).

1. Reconnaissance: Identify internet-accessible Mailpit SMTP server instances (default port 1025) using network scanners such as Shodan or Censys, targeting versions ≤ 1.28.2.
2. Establish TCP connection: Connect directly to the Mailpit SMTP port using a raw socket or SMTP client (e.g., nc, Python socket).
3. Initiate SMTP session: Send EHLO test.com\r\n and receive the server banner and capabilities.
4. Send MAIL FROM: Issue a normal MAIL FROM:<attacker@example.com>\r\n command.
5. Inject malicious RCPT TO: Send a crafted RCPT TO command embedding a bare CR in the address, e.g., RCPT TO:<victim\rINJECTED-HEADER: YES>\r\n. The server responds with 250 OK because the regex does not block \r.
6. Complete the DATA phase: Send DATA\r\n, followed by email headers and body (e.g., Subject: Test\r\n\r\nBody\r\n.\r\n).
7. Observe injection: The stored .eml file's Received header now contains the bare CR, creating a new line with the injected content. Downstream mail clients or MTAs that process the exported email may interpret the bare CR as a full line break, completing the header injection (Mailpit Advisory, Github Advisory).

• Network: Unexpected raw TCP connections to Mailpit's SMTP port (default 1025) from external or untrusted hosts; SMTP sessions containing non-printable characters (e.g., 0x0D bare CR, 0x00 null byte) in RCPT TO or MAIL FROM arguments.
• Logs: SMTP server logs showing RCPT TO or MAIL FROM commands with unusual or non-ASCII characters in the address field; 250 OK responses to addresses containing control characters.
• File System: Stored .eml files in the Mailpit data directory containing bare CR (\r) characters within the Received header line, visible when inspecting raw file content with a hex editor or cat -A; malformed To: fields showing empty or truncated addresses (indicative of null byte injection).
• Application Behavior: Mailpit API returning empty [] for the To field in message summaries, which may indicate null byte injection in the recipient address (Mailpit Advisory).

Upgrade Mailpit to version 1.28.3 or later, which fixes the vulnerability by replacing the flawed regex-based validation with Go's net/mail.ParseAddress() function to enforce RFC 5322 compliance on all RCPT TO and MAIL FROM addresses (Mailpit Release, Patch Commit). If immediate patching is not possible, restrict network access to the Mailpit SMTP port (default 1025) to trusted hosts only using firewall rules or network segmentation. Review SMTP logs for any addresses containing control characters as a precautionary measure.

The vulnerability was responsibly disclosed by security researcher omarkurt and acknowledged by the Mailpit maintainer, who credited both omarkurt and mdisec in the v1.28.3 release notes (Mailpit Release). The issue received coverage on dev.to and cvereports.com, and a Nuclei detection template was contributed to the ProjectDiscovery community templates repository, reflecting active interest from the security scanning community (Github Advisory).