High, CVSS 7.7MavenPublished
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
CVE-2025-59419 · GHSA-jq43-27x9-3v86
- Affected
- Maven io.netty:netty-codec-smtp >= 4.2.0.Alpha1, < 4.2.7.Final; < 4.1.128.Final
- Fixed in
- 4.2.7.Final4.1.128.Final· Vendor fix available
- Issue
- An SMTP Command Injection (CRLF Injection) vulnerability in Netty's SMTP codec allows a remote attacker who can control SMTP command parameters (e.g., an email recipient) to forge arbitrary emails from the trusted server. This bypasses standard email authentication and can be used to impersonate executives and forge high-stakes corporate communications. Details The root cause is the lack of input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerable code is in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string. For example, when SmtpRequests.rcpt(recipient) is called, a malicious recipient string containing CRLF sequences can inject a new, separate SMTP command. Because the injected commands are sent from the server's trusted IP, any resulting emails will likely pass SPF and DKIM checks, making them appear legitimate to the victim's email client. PoC A…
Recommended action: Upgrade to 4.2.7.Final or 4.1.128.Final by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.