CVE-2025-59419

What it actually does

The SMTP codec in Netty concatenates user-supplied parameters directly into SMTP command strings without sanitizing CRLF characters in DefaultSmtpRequest, enabling injection of arbitrary SMTP commands via methods such as SmtpRequests.rcpt.

Why it matters to the business

Organizations using vulnerable Netty versions risk having their trusted mail servers abused to send forged emails that bypass SPF and DKIM checks, enabling credible impersonation of executives and fraudulent corporate communications.

How an attack unfolds

An attacker supplies a malicious string containing CRLF sequences to an SMTP parameter such as a recipient address in application code that calls Netty SMTP methods. The injected commands are executed as part of traffic originating from the server's trusted IP address, resulting in forged emails that appear legitimate.

How to fix it

Upgrade Netty to version 4.1.129.Final or 4.2.8.Final. No workarounds are available.

How to confirm the fix worked

Confirm the Netty dependency version is 4.1.129.Final or newer in all affected projects and verify that SMTP parameter inputs are no longer directly concatenated without sanitization.

Typical attack path

1. Locate application code paths that pass unsanitized user input to Netty SMTP request methods
2. Craft a parameter value containing CRLF followed by arbitrary SMTP commands
3. Trigger the vulnerable SMTP request to cause the server to emit the injected commands
4. Send forged emails that pass authentication checks due to originating from the trusted server

How to detect it

Review application and mail server logs for SMTP command sequences containing unexpected CRLF characters or injected commands such as additional RCPT TO or DATA blocks originating from Netty-based services.

What your security team should do

• Immediately upgrade all Netty instances to 4.1.129.Final or 4.2.8.Final
• Audit code for direct use of SmtpRequests methods with untrusted parameters
• Add input validation or sanitization for any email-related fields passed to SMTP codecs