CVE-2026-67445 is a pre-authentication memory exhaustion vulnerability in Mailpit's SMTP layer. The bug lives in the gap between reading input and validating its length: Mailpit uses bufio.Reader.ReadString() to consume an entire line before parseLine() enforces the RFC 5321 512-octet limit. ReadString fully allocates whatever bytes precede the delimiter, and only then does length validation occur. This ordering—invert from what the RFC intends—creates a vector where a single oversized SMTP command can exhaust server memory before any authentication or command processing happens.
What makes this vulnerability significant is that it survives standard fuzzing. Memory exhaustion from a single oversized input doesn't manifest as a parse error or crash—it manifests as growing RSS and potential OOM, which test infrastructure typically attributes to the harness itself rather than the target. Coverage-guided fuzzers optimize for code path exploration, not allocation budgeting, so this pattern evades detection unless your harness explicitly treats memory profiling as an oracle.
The fix—enforcing the 512-octet limit inside readLine() before returning—is correct because the 512-octet limit is a resource constraint that belongs at the I/O layer, not a semantic constraint requiring protocol state. This is fundamentally different from SMTP correctness rules (EHLO sequencing, AUTH mechanism selection, DATA boundaries) which legitimately belong at higher layers because they depend on context. Resource limits that require allocation-aware enforcement belong at the read layer; state-dependent validation does not.
The broader pattern here is older than Mailpit. CVE-2019-15846 in Exim, CVE-2022-32250 in Postfix's SIZE handling, and HTTP Request Smuggling variants share the same root cause: reading input before constraining what was read. The common failure mode is treating allocation as free until it isn't. If you maintain Go network services using bufio.Reader or similar primitives, audit where ReadString or ReadBytes are called without prior size bounds—this is the specific pattern that creates this vulnerability class.