Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 13 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerability exists in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string without sanitization. When methods such as SmtpRequests.rcpt(recipient) are called with a malicious string containing CRLF sequences, attackers can inject arbitrary SMTP commands. Because the injected commands are sent from the server's trusted IP address, resulting emails will likely pass SPF and DKIM authentication checks, making them appear legitimate. This allows remote attackers who can control SMTP command parameters (such as email recipients) to forge arbitrary emails from the trusted server, potentially impersonating executives and forging high-stakes corporate communications. This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. No known workarounds exist.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| netty | netty | before 4.2.7.Final; 4.2.0.Alpha1 to before 4.1.128.Final | 4.2.7.Final, 4.1.128.Final | Patch available | CNA |
| — | io.netty:netty-codec-smtp (Maven) | 4.2.0.Alpha1 to before 4.2.7.Final | 4.2.7.Final | Patch available | GHSA-jq43-27x9-3v86 |
| — | io.netty:netty-codec-smtp (Maven) | before 4.1.128.Final | 4.1.128.Final | Patch available | GHSA-jq43-27x9-3v86 |
- netty Vendornetty Affected before 4.2.7.Final; 4.2.0.Alpha1 to before 4.1.128.Final Fixed in 4.2.7.Final, 4.1.128.Final Patch available CNA
- io.netty:netty-codec-smtp (Maven) Vendor— Affected 4.2.0.Alpha1 to before 4.2.7.Final Fixed in 4.2.7.Final Patch available GHSA-jq43-27x9-3v86
- io.netty:netty-codec-smtp (Maven) Vendor— Affected before 4.1.128.Final Fixed in 4.1.128.Final Patch available GHSA-jq43-27x9-3v86
Remediation
- Fix · CNA netty (netty) Fixed in 4.2.7.Final, 4.1.128.Final
- Fix · GHSA-jq43-27x9-3v86 io.netty:netty-codec-smtp (Maven) Fixed in 4.2.7.Final Advisory →
- Fix · GHSA-jq43-27x9-3v86 io.netty:netty-codec-smtp (Maven) Fixed in 4.1.128.Final Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59419
- 2026-10-03 Alias added: GHSA-jq43-27x9-3v86
References
Other 6
- https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86
- https://github.com/netty/netty/commit/1782e8c2060a244c4d4e6f9d9112d5517ca05120
- https://github.com/netty/netty/commit/2b3fddd3339cde1601f622b9ce5e54c39f24c3f9
- https://gist.github.com/DepthFirstDisclosures/ddacca28cb94b48fa8ab998cef59ed8c
- https://github.com/netty/netty
- https://www.depthfirst.com/post/our-ai-agent-found-a-netty-zero-day-that-bypasses-email-authentication-the-story-of-cve-2025-59419
More netty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
- TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
- TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
- TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVSS 4.0HIGH 8.7
- TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVSS 4.0HIGH 8.7
Sources
- CVE-2025-59419 · CVE Program
- CVE-2025-59419 · NVD
- FIRST EPSS
- GHSA-jq43-27x9-3v86 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-59419 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences