CVE-2025-59419 Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery
Attackers can inject SMTP commands via CRLF characters to forge emails from trusted servers, bypassing SPF/DKIM checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59419?
CVE-2025-59419 is a medium-severity command injection vulnerability in netty, published on 15 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerability exists in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string without sanitization. When methods such as SmtpRequests.rcpt(recipient) are called with a malicious string containing CRLF sequences, attackers can inject arbitrary SMTP commands. Because the injected commands are sent from the server's trusted IP address, resulting emails will likely pass SPF and DKIM authentication checks, making them appear legitimate. This allows remote attackers who can control SMTP command parameters (such as email recipients) to forge arbitrary emails from the trusted server, potentially impersonating executives and forging high-stakes corporate communications. This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. No known workarounds exist.
Weakness: CWE-93
Which versions are affected by CVE-2025-59419?
4 open source packages ship an affected version, including io.netty:netty-codec-smtp.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty-codec-smtp Maven | All versions | 4.1.128.Final |
io.netty:netty-codec-smtp Maven | All versions | 4.1.128.Final |
io.netty:netty-codec-smtp Maven | From 4.2.0.Alpha1 | 4.2.7.Final |
io.netty:netty-codec-smtp Maven | From 4.2.0.Alpha1 | 4.2.7.Final |
Linux distribution packages (7)
netty-tcnative SUSE:Linux Enterprise Module for Development Tools 15 SP6 | All versions | 2.0.74-150200.3.33.1 |
netty-tcnative SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 2.0.74-150200.3.33.1 |
netty SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 4.1.128-150200.4.37.1 |
netty SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 4.1.128-150200.4.37.1 |
netty openSUSE:Leap 15.6 | All versions | 4.1.128-150200.4.37.1 |
netty-tcnative openSUSE:Leap 15.6 | All versions | 2.0.74-150200.3.33.1 |
netty openSUSE:Tumbleweed | All versions | 4.1.128-1.1 |
How do I fix CVE-2025-59419?
Upgrade io.netty:netty-codec-smtp to a fixed version for your release line: 4.1.128.Final or 4.2.7.Final.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-59419 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59419 exists.
Sources
Also known as CLEANSTART-2026-FZ71695, CLEANSTART-2026-MB73363, DEBIAN-CVE-2025-59419, GHSA-jq43-27x9-3v86, MINI-499w-vfx7-7cg6, MINI-4ww5-wq95-r878 and 13 more.