https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:55:52 +0000 https://db.gcve.eu/vuln/ghsa-jq43-27x9-3v86 <p><strong>Affected:</strong> Maven: io.netty:netty-codec-smtp</p> <p>### Summary An SMTP Command Injection (CRLF Injection) vulnerability in Netty&#39;s SMTP codec allows a remote attacker who can control SMTP command parameters (e.g., an email recipient) to forge arbitrary emails from the trusted server. This bypasses standard email authentication and can be used to impersonate executives and forge high-stakes corporate communications.</p> <p>### Details The root cause is the lack of input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters.</p> <p>The vulnerable code is in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string. For example, when SmtpRequests.rcpt(recipient) is called, a malicious recipient string containing CRLF sequences can inject a new, separate SMTP command.</p> <p>Because the injected commands are sent from the server&#39;s trusted IP, any resulting emails will likely pass SPF and DKIM checks, making them appear legitimate to the victim&#39;s email client.</p> <p>### PoC A minimal PoC involves passing a crafted string containing CRLF sequences to any `SmtpRequest` that accepts user-controlled parameters.</p> <p>**1. Malicious Payload**</p> <p>The core of the exploit is the payload, where new SMTP commands are injected into a parameter.</p> <p>```java // The legitimate recipient is followed by an injected email sequence String injected_recipient = &#34;legit-recipient@example.com\r\n&#34; + &#34;MAIL FROM:&lt;ceo@trusted-domain.com&gt;\r\n&#34; +…</p> <p><strong>Affected:</strong> Maven: io.netty:netty-codec-smtp</p> <p>### Summary An SMTP Command Injection (CRLF Injection) vulnerability in Netty&#39;s SMTP codec allows a remote attacker who can control SMTP command parameters (e.g., an email recipient) to forge arbitrary emails from the trusted server. This bypasses standard email authentication and can be used to impersonate executives and forge high-stakes corporate communications.</p> <p>### Details The root cause is the lack of input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters.</p> <p>The vulnerable code is in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string. For example, when SmtpRequests.rcpt(recipient) is called, a malicious recipient string containing CRLF sequences can inject a new, separate SMTP command.</p> <p>Because the injected commands are sent from the server&#39;s trusted IP, any resulting emails will likely pass SPF and DKIM checks, making them appear legitimate to the victim&#39;s email client.</p> <p>### PoC A minimal PoC involves passing a crafted string containing CRLF sequences to any `SmtpRequest` that accepts user-controlled parameters.</p> <p>**1. Malicious Payload**</p> <p>The core of the exploit is the payload, where new SMTP commands are injected into a parameter.</p> <p>```java // The legitimate recipient is followed by an injected email sequence String injected_recipient = &#34;legit-recipient@example.com\r\n&#34; + &#34;MAIL FROM:&lt;ceo@trusted-domain.com&gt;\r\n&#34; +…</p> https://db.gcve.eu/vuln/ghsa-jq43-27x9-3v86