Is CVE-2026-93576 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93576 being exploited in the wild.

How severe is CVE-2026-93576?

High severity, with a CVSS score of 7.5, published 18 September 2026.

Which products and versions are affected?

Netty Project netty-codec-smtp.

Is there a fix for CVE-2026-93576?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93576 attacked?

It is attacked over the network.

Am I affected by CVE-2026-93576?

Check whether you run Netty Project Netty-Codec-Smtp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93576: Netty netty-codec-smtp CR/LF injection in SMTP command parsing

CVE-2026-93576 · Severity: high · CVSS 7.5 · Published 2026-09-18

Netty's SMTP codec library fails to properly filter carriage return and line feed characters in SMTP command fields, allowing attackers to inject arbitrary SMTP commands. An attacker exploiting this flaw could relay emails or spoof sender and recipient addresses through susceptible applications. Real-world risk is moderated by the requirement that applications must route untrusted user input directly into the vulnerable field.

Vendors: Netty Project.

Quick answers

Is CVE-2026-93576 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93576 being exploited in the wild.
How severe is CVE-2026-93576?: High severity, with a CVSS score of 7.5, published 18 September 2026.
Which products and versions are affected?: Netty Project netty-codec-smtp.
Is there a fix for CVE-2026-93576?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93576 attacked?: It is attacked over the network.
Am I affected by CVE-2026-93576?: Check whether you run Netty Project Netty-Codec-Smtp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The netty-codec-smtp component lacks validation of CR (U+000D) and LF (U+000A) characters in the SMTP command-name field, enabling SMTP command injection via header smuggling. The vulnerability requires network access and untrusted input to be passed to the vulnerable parsing function; applications that do not populate command-name fields from user input are unaffected. Successful exploitation grants the attacker the ability to inject arbitrary SMTP commands, facilitating relay attacks or address spoofing.

Affected products

Netty Project netty-codec-smtp

Timeline

2026-09-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.