{"id":"CVE-2026-45712","aliases":["GHSA-w4vj-r5pg-3722","GO-2026-5689"],"url":"https://o3.security/vulnerability/CVE-2026-45712","summary":"Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)","details":"Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go's runtime raises fatal error: concurrent map read and map write — a runtime.throw that is not recoverable by http.Server's handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it. Version 1.30.0 contains a patch.","published":"2026-07-20T14:59:40.516Z","modified":"2026-08-12T03:51:44.993023095Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00247,"percentile":0.16168,"asOf":"2026-08-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/axllent/mailpit","fixedVersion":"1.30.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/axllent/mailpit/releases/tag/v1.30.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45712.json"},{"type":"ADVISORY","url":"https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45712"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:44.993023095Z"}}