← CVE Intelligence

CVE-2026-93576

Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419) PUBLISHED

Description (CNA)

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Apache Camel for Spring Boot 4affected
Red Hat / Red Hat Fuse 7unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform 7affected
Red Hat / Red Hat JBoss Enterprise Application Platform 7affected
Red Hat / Red Hat JBoss Enterprise Application Platform 7affected
Red Hat / Red Hat JBoss Enterprise Application Platform 7affected
Red Hat / Red Hat Single Sign-On 7affected

CWE

CWE-93

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.