Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerability exists in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string without sanitization. When methods such as SmtpRequests.rcpt(recipient) are called with a malicious string containing CRLF sequences, attackers can inject arbitrary SMTP commands. Because the injected commands are sent from the server's trusted IP address, resulting emails will likely pass SPF and DKIM authentication checks, making them appear legitimate. This allows remote attackers who can control SMTP command parameters (such as email recipients) to forge arbitrary emails from the trusted server, potentially impersonating executives and forging high-stakes corporate communications. This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. No known workarounds exist.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-06 | 1 | Exploit1 |
| 2026-02-19 | 1 | Disclosure1 |
| 2026-09-18 | 1 | Disclosure1 |
| 2026-09-20 | 1 | Patch1 |
https://depthfirst.com/post/casting-a-net-ty-for-bugs-and-catching-a-big-one-cve-2025-59419?utm_source=tldrinfosec&utm_medium=newsletter&utm_campaign=2026Q1_newsletter_TLDRInfoSec&utm_content=secondary_placement&utm_term=blog_post
Post summary
DepthFirst’s post on CVE-2025-59419 details the discovery, provides a functional PoC/exploit, and references vendor patches, but does not report active exploitation in the wild.
Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419) #Netty #CVE202559419 #SMTPInjection #AISecurity #ZeroDay https://depthfirst.com/post/casting-a-net-ty-for-bugs-and-catching-a-big-one-cve-2025-59419
Post summary
The tweet announces a new zero‑day SMTP injection vulnerability in Netty (CVE-2025-59419), providing its classification and severity but no exploit, mitigation, or active usage details.
Netty netty-codec-smtp — SMTP command-name field is not CRLF-validated (incomplete fix of CVE-2025-59419) https://t.co/hkUziL1V9X
Netty netty-codec-smtp — SMTP command-name field is not CRLF-validated (incomplete fix of CVE-2025-59419) https://t.co/wa0ZKhS9Bo
Post summary
The tweet highlights that Netty's SMTP command-name field still lacks proper CRLF validation, indicating the fix for CVE‑2025‑59419 remains incomplete and a more complete patch is needed.
CVE-2026-93576 Netty netty-codec-smtp — SMTP command-name field is not CRLF-validated (incomplete fix of CVE-2025-59419) https://www.cve.org/CVERecord?id=CVE-2026-93576
Post summary
The tweet discloses CVE-2026-93576 affecting Netty’s netty‑codec‑smtp, noting that the SMTP command‑name field lacks proper CRLF validation, representing an incomplete fix for a prior CVE.