CVE-2025-59937 go-mail has insufficient address encoding when passing mail addresses to the SMTP client
Attackers can manipulate SMTP commands via crafted email addresses, potentially causing wrong routing or parameter smuggling in applications using this Go library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59937?
CVE-2025-59937 is a high-severity vulnerability in wneessen go-mail, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1
Weakness: CWE-88
Which versions are affected by CVE-2025-59937?
3 open source packages ship an affected version, including github.com/wneessen/go-mail. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/wneessen/go-mail Go | All versions | 0.7.1 |
github.com/wneessen/go-mail Go | All versions | 0.7.1 |
github.com/wneessen/go-mail Go | All versions | 0.7.1 |
Products include Pebcak Go-Mail.
How do I fix CVE-2025-59937?
Upgrade github.com/wneessen/go-mail to 0.7.1 or later.
Is CVE-2025-59937 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59937 exists.
Sources
Also known as GHSA-wpwj-69cm-q9c5, GO-2025-3988.