FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

mailpit -- Unbounded CPU and memory consumption in thumbnail endpoint via cyclic EXIF IFD chain

Affected packages
mailpit < 1.32.0

Details

VuXML ID df4083bc-cea6-11f1-94b3-10ffe07f9334
Discovery 2026-10-23
Entry 2026-10-23

Mailpit author reports:

The thumbnail endpoint GET /api/v1/message/{ID}/part/{PartID}/thumb parses EXIF metadata of image attachments with github.com/rwcarlsen/goexif to apply orientation. goexif's TIFF IFD walker only detects a self-referencing IFD (next == prev). An attachment whose IFD chain forms a cycle of length 2 (IFD0 → IFD1 → IFD0) sends the request handler into an infinite loop that appends a new *tiff.Dir on every iteration. The goroutine never terminates, pins one CPU core permanently, and its live heap grows without bound. A 651-byte JPEG is sufficient.

References

URL https://github.com/axllent/mailpit/security/advisories/GHSA-379p-g4f4-hq5h