PT-2025-42370

🗓️ 15 Oct 2025 00:00:00Reported by Positive TechnologiesType

Netty versions before 4.1.128.Final and 4.2.7.Final suffer SMTP command injection via CRLF.

Reporter	Title	Published	Views	Family All 643
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to command injection due to the Netty package (CVE-2025-59419)	13 Jan 202616:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	18 Dec 202501:19	–	ibm
IBM Security Bulletins	Security Bulletin: SMTP Command Injection Vulnerability in Netty SMTP Codec (Fixed in 4.1.129.Final and 4.2.8.Final) affect IBM watsonx.data	4 Mar 202615:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation	14 Apr 202215:51	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.	27 Jul 202610:45	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Google Protocol Buffers, IBM Operations Analytics – Log Analysis is affected by denial of service.	21 Apr 202612:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Netty affects IBM Netezza Appliance	16 Dec 202511:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Apache Tomcat, Netty, Lodash, Spring Framework and Node.js might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Google Protocol Buffers (CVE-2021-22570)	28 Jun 202320:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.6	15 Apr 202502:58	–	ibm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-52999
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-43642
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WK99982.json
osv	www.osv.dev/vulnerability/ghsa-f6hv-jmp6-3vwv
osv	www.osv.dev/vulnerability/CVE-2025-24860
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41417
osv	www.osv.dev/vulnerability/ghsa-cmxv-58fp-fm3g
osv	www.osv.dev/vulnerability/CVE-2024-35255
openeuler	www.openeuler.org/zh/security/security-bulletins/detail/
osv	www.osv.dev/vulnerability/ghsa-6v67-2wr5-gvf4

02 Oct 2026 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 46.9 - 8.7

CVSS 22.1

CVSS 3.15.5 - 6.5

EPSS0.0266

SSVC