HIGHMaven →
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
Affected packages
- io.netty:netty-codec-smtp— 4.2.0.Alpha1 → 4.2.7.Final
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86
- https://nvd.nist.gov/vuln/detail/CVE-2025-59419
- https://github.com/netty/netty/commit/1782e8c2060a244c4d4e6f9d9112d5517ca05120
- https://github.com/netty/netty/commit/2b3fddd3339cde1601f622b9ce5e54c39f24c3f9
- https://gist.github.com/DepthFirstDisclosures/ddacca28cb94b48fa8ab998cef59ed8c
- https://github.com/netty/netty
- https://www.depthfirst.com/post/our-ai-agent-found-a-netty-zero-day-that-bypasses-email-authentication-the-story-of-cve-2025-59419
Structured record: https://osv.dev/vulnerability/GHSA-jq43-27x9-3v86
Recommended response stack
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta