Executive brief
Netty's SMTP codec library fails to properly filter carriage return and line feed characters in SMTP command fields, allowing attackers to inject arbitrary SMTP commands. An attacker exploiting this flaw could relay emails or spoof sender and recipient addresses through susceptible applications. Real-world risk is moderated by the requirement that applications must route untrusted user input directly into the vulnerable field.
Technical details
The netty-codec-smtp component lacks validation of CR (U+000D) and LF (U+000A) characters in the SMTP command-name field, enabling SMTP command injection via header smuggling. The vulnerability requires network access and untrusted input to be passed to the vulnerable parsing function; applications that do not populate command-name fields from user input are unaffected. Successful exploitation grants the attacker the ability to inject arbitrary SMTP commands, facilitating relay attacks or address spoofing.
Affected products
- Netty Project netty-codec-smtp
Timeline
- 2026-09-18: disclosed