EUVD-2026-82976
GHSA-cr29-67c6-8878
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CRLF injection yields integrity-only impact (I:H, C:N/A:N); AC:H because exploitation requires an app to relay untrusted input into the SMTP command-name field.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
Netty netty-codec-smtp - SMTP command-name field is not CRLF-validated (incomplete fix of CVE-2025-59419)
AnalysisAI
SMTP command injection in Netty's netty-codec-smtp allows unauthenticated remote attackers to inject arbitrary SMTP commands via CRLF sequences in the command-name field, affecting applications built on Netty such as Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7. This is an incomplete fix of CVE-2025-59419, requiring attacker-controlled input to reach the SMTP command name and a downstream SMTP server that acts on smuggled commands; no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an application built on Netty's netty-codec-smtp that constructs SMTP commands where the command-name field is populated from attacker-influenced input; because that field is not neutralized for CR/LF, embedded `\r\n` sequences inject additional SMTP commands. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine integrity flaw, not the information-disclosure issue its tag implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7, and identify any that use Netty's netty-codec-smtp for SMTP communications; within 7 days, implement interim mitigations such as strict input validation to block CRLF sequences in SMTP command names, configure downstream SMTP servers to reject malformed commands, and enable monitoring for anomalous SMTP traffic; within 30 days, continue monitoring vendor advisories for a patched version of Netty and the affected Red Hat products, and develop a remediation plan to upgrade once patches are released.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Fuse 7
View allHTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts,
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak
Netty's codec-rtsp component silently normalizes away trailing control bytes in RTSP method tokens, so a wire request wh
Share
External POC / Exploit Code
Leaving vuln.today