CVE-2026-23829

CVE-2026-23829 is a Header Injection vulnerability affecting Mailpit versions prior to 1.28.3. The SMTP server's insufficient regular expression for validating RCPT TO and MAIL FROM addresses allows attackers to inject arbitrary SMTP headers by including carriage return characters. This vulnerability has a CVSS score of 5.3 (Medium), indicating it can be exploited remotely with low complexity and no user interaction, leading to a low impact on integrity. There is currently no evidence of active exploitation, nor are there public exploit codes like Metasploit or Nuclei modules, though it has garnered significant community discussion.