SMTP Command-Name Field Vulnerability in Netty Codec SMTP from Red Hat
CVE-2026-93576

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Apache Camel For Spring Boot 4
Red Hat Fuse 7
Red Hat Jboss Enterprise Application Platform 7
Red Hat Single Sign-on 7
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93576?

An input validation flaw exists in the SMTP command-name field of Netty's codec-smtp component. This vulnerability stems from an incomplete fix to a prior issue, failing to properly validate command names according to CRLF standards, which could lead to potential security risks, including injection attacks. It is essential for organizations using affected versions to apply the appropriate updates to mitigate exposure.

References

https://access.redhat.com/security/cve/CVE-2026-93576
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536968
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.