CVE-2025-59419

Publication date 15 October 2025

Last updated 29 October 2025

Ubuntu priority

Medium

Why this priority?

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerability exists in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string without sanitization. When methods such as SmtpRequests.rcpt(recipient) are called with a malicious string containing CRLF sequences, attackers can inject arbitrary SMTP commands. Because the injected commands are sent from the server's trusted IP address, resulting emails will likely pass SPF and DKIM authentication checks, making them appear legitimate. This allows remote attackers who can control SMTP command parameters (such as email recipients) to forge arbitrary emails from the trusted server, potentially impersonating executives and forging high-stakes corporate communications. This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. No known workarounds exist.

Status

Package Ubuntu Release Status
netty 25.10 questing
Fixed 1:4.1.48-10ubuntu0.25.10.1
25.04 plucky
Fixed 1:4.1.48-10ubuntu0.25.04.1
24.04 LTS noble
Fixed 1:4.1.48-9ubuntu0.1~esm2
22.04 LTS jammy
Fixed 1:4.1.48-4+deb11u2ubuntu0.1~esm2
20.04 LTS focal
Fixed 1:4.1.45-1ubuntu0.1~esm3
18.04 LTS bionic
Fixed 1:4.1.7-4ubuntu0.1+esm4
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

References

Related Ubuntu Security Notices (USN)

Other references