io.netty:netty-codec-smtp
This is a mature, actively released Maven component with 167 releases over more than 10 years, 21 releases in the last 12 months, stable-version history, no registry deprecation, modest runtime dependencies, and Maven PGP build provenance. The artifact has a coherent library file tree and no install-time scripts. Adoption is tempered by the absence of a declared license or license file and by the package's missing repository declaration, which reduces transparency; repository maintenance and contributor activity therefore cannot be verified from the collected signals.
78%
Total Score
100
80
100
100
Health checks
No declared license and no license file were found, leaving the legal terms of use unclear. This is a genuine transparency concern for dependency adoption.
The artifact has no README, tests, or changelog, and repository equivalents were not available for comparison. For a focused binary library this is not by itself evidence of abandonment, but it limits release-level documentation and verification.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-645787 New netty-codec-smtp is vulnerable to Denial of Service (DoS) in versions 4.1.0.Final - 4.1.137.Final and 4.2.0.Final - 4.2.17.Final. | 4.1.0.Final - 4.1.137.Final4.2.0.Final - 4.2.17.Final | High |
CVE-2025-59419 io.netty:netty-codec-smtp is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 4.2.0.Alpha1 - 4.2.7.Final and 0.0.0 - 4.1.128.Final. | 0.0.0 - 4.1.128.Final4.2.0.Alpha1 - 4.2.7.Final | High |
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ${project.groupId}:netty-common Version 4.2.18.Final | — | — |
${project.groupId}:netty-buffer Version 4.2.18.Final | — | — |
${project.groupId}:netty-transport Version 4.2.18.Final | — | — |
${project.groupId}:netty-codec-base Version 4.2.18.Final | — | — |
org.reflections:reflections Version * | — | — |
Weekly Downloads
Info
- Last Published
- 7 days ago
- Created
- 10 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.