Netty SMTP Execution

🗓️ 18 Nov 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 18 Views

Netty data sanitization gap at management and control levels enables remote SMTP command execution.

Reporter	Title	Published	Views	Family All 302
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to command injection due to the Netty package (CVE-2025-59419)	13 Jan 202616:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	18 Dec 202501:19	–	ibm
IBM Security Bulletins	Security Bulletin: SMTP Command Injection Vulnerability in Netty SMTP Codec (Fixed in 4.1.129.Final and 4.2.8.Final) affect IBM watsonx.data	4 Mar 202615:28	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Netty affects IBM Netezza Appliance	16 Dec 202511:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Apache Tomcat, Netty, Lodash, Spring Framework and Node.js might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
Chainguard	CVE-2025-59419 vulnerabilities	17 Oct 202513:22	–	cgr
Circl	CVE-2025-59419	15 Oct 202514:36	–	circl
CNNVD	Netty 注入漏洞	15 Oct 202500:00	–	cnnvd
CVE	CVE-2025-59419	15 Oct 202515:42	–	cve
Cvelist	CVE-2025-59419 Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery	15 Oct 202515:42	–	cvelist

Vulners

Node

OR

apache nettyRange<4.1.128

apache nettyRange4.2.0–4.2.7

google android_studioMatch2025.2.3.9

Source	Link
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-netty-cve-2025-59419/
github	www.github.com/netty/netty/commit/1782e8c2060a244c4d4e6f9d9112d5517ca05120
github	www.github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.15/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.2/
web	www.web.nvd.nist.gov/view/vuln/detail

23 Sep 2026 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 25

CVSS 35.3

EPSS0.01553

netty framework data sanitization management level control level remote execution mail commands