CVE-2026-93576 Command injection in Red Hat Fuse 7
Remote attackers can inject SMTP commands via unvalidated CR/LF characters in the command-name field, enabling email relay or spoofing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93576?
CVE-2026-93576 is a high-severity command injection vulnerability in Red Hat Fuse 7, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.
Weakness: CWE-93
Which versions are affected by CVE-2026-93576?
How do I fix CVE-2026-93576?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-93576 being exploited?
There is no known exploitation of CVE-2026-93576 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93576, GHSA-cr29-67c6-8878, UBUNTU-CVE-2026-93576.