CVE-2025-59419

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerability exists in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string without sanitization. When methods such as SmtpRequests.rcpt(recipient) are called with a malicious string containing CRLF sequences, attackers can inject arbitrary SMTP commands. Because the injected commands are sent from the server's trusted IP address, resulting emails will likely pass SPF and DKIM authentication checks, making them appear legitimate. This allows remote attackers who can control SMTP command parameters (such as email recipients) to forge arbitrary emails from the trusted server, potentially impersonating executives and forging high-stakes corporate communications. This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. No known workarounds exist.

• CWE-93

• https://github.com/netty/netty/commit/1782e8c2060a244c4d4e6f9d9112d5517ca05120
• https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86
• https://www.depthfirst.com/post/our-ai-agent-found-a-netty-zero-day-that-bypasses-email-authentication-the-story-of-cve-2025-59419

Published

Oct 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59413CubeCart is an ecommerce software solution. Prior to version…6.5
• CVE-2025-59414Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2025-59415Frappe Learning is a learning system that helps users struct…5.4
• CVE-2025-59416The Scratch Channel is a news website. If the user makes a f…7.2
• CVE-2025-59417Lobe Chat is an open-source artificial intelligence chat fra…6.1
• CVE-2025-59418BunnyPad is a note taking software. Prior to version 11.0.27…5.5
• CVE-2025-5942Netskope was notified about a potential gap in its agent (NS…5.7
• CVE-2025-59420Authlib is a Python library which builds OAuth and OpenID Co…7.5
• CVE-2025-59421Press, a Frappe custom app that runs Frappe Cloud, manages i…2.7
• CVE-2025-59422Dify is an open-source LLM app development platform. In vers…3.1
• CVE-2025-59424LinkAce is a self-hosted archive to collect website links. P…7.3
• CVE-2025-59425vLLM is an inference and serving engine for large language m…7.5