AIKIDO-2026-259011
netty-codec-smtp is vulnerable to CRLF Injection
65
Medium Risk
This Affects:
netty-codec-smtpTL;DR
This is an incomplete-fix follow-up to CVE-2025-59419, which validated SMTP request parameters but left the command-name field unchecked. SmtpCommand.valueOf() performs no validation and SmtpRequestEncoder writes the command verbatim, so CR or LF embedded in a command name injects additional SMTP commands onto the wire. An application that builds commands from externally influenced input can have extra CRLF-separated commands smuggled through a single request. The fix validates the command-name field for CR and LF.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application sends SMTP commands built from externally influenced input.
Background info
netty-codec-smtp is vulnerable to CRLF Injection in versions 0.0.1 - 4.1.137.Final and 4.2.0.Final - 4.2.17.Final.
How to fix this
Upgrade the io.netty:netty-codec-smtp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.