Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes") wrapped only "POST /api/v1/send" with "http.MaxBytesReader". The four other Mailpit JSON-body API endpoints "PUT /api/v1/messages" (SetReadStatus), "DELETE /api/v1/messages" (DeleteMessages), "PUT /api/v1/tags" (SetMessageTags), and "POST /api/v1/message/{id}/release" (ReleaseMessage) still call "json.NewDecoder(r.Body)" directly with no body-size cap and remain reachable unauthenticated in the default "docker run axllent/mailpit:latest" deploy. An unauthenticated remote attacker can post a multi-million-element "IDs" slice and drive RSS from ~25 MiB baseline to ~450 MiB per 16 MB request body. Repeating across multiple connections accumulates the same per-request amplification per process. Version 1.30.1 contains a patch.