CVE-2025-59419: 
Java vulnerability analysis and mitigation

Netty, an asynchronous event-driven network application framework, was found to contain an SMTP command injection vulnerability (CVE-2025-59419) in versions prior to 4.1.128.Final and 4.2.7.Final. The vulnerability exists in the SMTP codec due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters, specifically in io.netty.handler.codec.smtp.DefaultSmtpRequest. The issue was discovered in October 2025 and affects applications using netty-codec-smtp to construct SMTP requests (GitHub Advisory, NVD).

The vulnerability stems from the direct concatenation of parameters into SMTP command strings without proper sanitization. When methods like SmtpRequests.rcpt(recipient) are called with a malicious string containing CRLF sequences, attackers can inject arbitrary SMTP commands. The vulnerability has been assigned a CVSS v4.0 score of 5.5 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. The issue is classified as CWE-93 (Improper Neutralization of CRLF Sequences) (GitHub Advisory, RedHat).

The vulnerability allows remote attackers who can control SMTP command parameters to forge arbitrary emails from trusted servers. Because the injected commands are sent from the server's trusted IP address, resulting emails bypass standard email authentication mechanisms including SPF, DKIM, and DMARC checks. This enables sophisticated phishing attacks and potential economic manipulation through forged high-stakes corporate communications (DepthFirst, GitHub Advisory).

The vulnerability has been patched in Netty versions 4.1.129.Final and 4.2.8.Final. No known workarounds exist for unpatched versions. Organizations using affected versions of Netty should upgrade to the patched versions immediately (NVD, GitHub Advisory).

The discovery sparked a discussion within the Netty maintainer community about the responsibility of input validation in low-level APIs. The maintainers ultimately decided to follow existing precedent, noting that Netty already performs similar input validation in its HTTP codec. The vulnerability was discovered by DepthFirst's AI security agent and was responsibly disclosed to the Netty maintainers (DepthFirst).