Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419) | depthfirst

What it is

CVE-2025-59419 is an SMTP command injection in the SMTP codec of Netty, the Java networking library. depthfirst's security agent found the flaw, assessed the risk and generated the patch without human input. The Netty maintainers assigned the CVE and merged the fix. The page does not give affected or fixed version numbers.

How it works

Netty's SMTP codec accepted \r\n inside values that become part of a command. The page shows the vulnerable pattern, where application-supplied input is concatenated into a request:

DefaultSmtpRequest(SmtpCommand.RCPT, "TO:<" + recipient + '>')

If an attacker controls recipient, they can set it to anyone@anywhere.com\r\nFROM: <ceo@example.com>\r\n. The server then reads two commands:

RCPT TO: <anyone@anywhere.com>\r\n
FROM: <ceo@example.com>\r\n

The page says further injected commands can set the message content and send multiple emails.

Preconditions / Affected

An application must use Netty to send mail and let a user control a value that reaches an SMTP command, such as a recipient address. The page's example is a company that sends alerts to user-configured addresses.

The page says the forged mail passes the usual checks:

• SPF passes because the mail leaves the company's own trusted server.
• DKIM passes because the forged message is built on the server before signing.
• DMARC fails to help because it depends on SPF and DKIM.

The page names business email compromise and phishing as the resulting risks, for example a forged message from a CFO to accounting asking for a wire transfer.

What to do

The page gives no upgrade instructions or version numbers. Its implied action is to treat any user-influenced value that reaches Netty's SMTP request construction as untrusted. Reject or strip \r and \n in that input, and take the Netty release containing the merged fix (check the project's advisory for the version).

Caveats

The maintainers disagreed over whether Netty or its users should validate input. Some saw Netty as a low-level API where callers do their own checks. Others held that the library should enforce security. The fix went ahead because Netty's HTTP codec already rejects such characters, and because PHPMailer and Apache James had fixed and assigned CVEs for similar SMTP injection flaws.

The page's example payload uses FROM: where standard SMTP uses MAIL FROM:. It gives no severity score and no proof-of-concept beyond this example.