CVE-2025-59937

go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1

• CWE-88
• CWE-88

• https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479Patch
• https://github.com/wneessen/go-mail/issues/495Exploit, Issue Tracking
• https://github.com/wneessen/go-mail/pull/496Issue Tracking, Patch
• https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5Vendor Advisory
• https://github.com/wneessen/go-mail/issues/495Exploit, Issue Tracking

Published

Sep 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59930Rejected reason: Not used
• CVE-2025-59932Flag Forge is a Capture The Flag (CTF) platform. From versio…8.2
• CVE-2025-59933libvips is a demand-driven, horizontally threaded image proc…7.8
• CVE-2025-59934Formbricks is an open source qualtrics alternative. Prior to…9.4
• CVE-2025-59935GLPI is a free asset and IT management software package. Sta…6.5
• CVE-2025-59936get-jwks contains fetch utils for JWKS keys. In versions pri…9.4
• CVE-2025-59938Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2025-59939WeGIA is a Web manager for charitable institutions. Prior to…8.8
• CVE-2025-5994A multi-vendor cache poisoning vulnerability named 'Rebirthd…8.7
• CVE-2025-59940mkdocs-include-markdown-plugin is an Mkdocs Markdown include…6.5
• CVE-2025-59941go-f3 is a Golang implementation of Fast Finality for Fileco…6.5
• CVE-2025-59942go-f3 is a Golang implementation of Fast Finality for Fileco…7.5