SMTP Command Injection Vulnerability in Netty Framework
CVE-2025-59419

5.5MEDIUM

Key Information:

Vendor

Netty

Status
Netty
Vendor
CVE Published:
15 October 2025

What is CVE-2025-59419?

The Netty framework, an asynchronous and event-driven network application tool, is impacted by a significant SMTP command injection vulnerability. This flaw arises from inadequate input validation in the SMTP codec, notably within the DefaultSmtpRequest handler. Attackers can exploit this weakness by injecting malicious CRLF characters into SMTP command parameters, leading to unauthorized command execution. This vulnerability allows the crafting of forged emails that appear to originate from a trusted server, bypassing security measures such as SPF and DKIM authentication. The affected versions have been patched in Netty releases 4.1.129.Final and 4.2.8.Final, with no known workarounds available.

Affected Version(s)

netty < 4.2.7.Final < 4.2.7.Final

netty >= 4.2.0.Alpha1, < 4.1.128.Final < 4.2.0.Alpha1, 4.1.128.Final

References

https://github.com/netty/netty/security/advisories/GHSA-j...
x_refsource_CONFIRM
https://github.com/netty/netty/commit/1782e8c2060a244c4d4...
x_refsource_MISC

CVSS V4

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-59419 : SMTP Command Injection Vulnerability in Netty Framework