Vulnerability-Lookup

CVE-2025-59937 (GCVE-0-2025-59937)

Vulnerability from cvelistv5 – Published: 2025-09-29 22:21 – Updated: 2025-09-30 14:44

Title

go-mail has insufficient address encoding when passing mail addresses to the SMTP client

Summary

go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-30 14:43 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7730 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/wneessen/go-mail/security/advi…	x_refsource_CONFIRM
https://github.com/wneessen/go-mail/issues/495	x_refsource_MISC
https://github.com/wneessen/go-mail/pull/496	x_refsource_MISC
https://github.com/wneessen/go-mail/commit/42e92c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
wneessen	go-mail	Affected: < 0.7.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59937",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-30T14:43:56.630417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T14:44:35.194Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/wneessen/go-mail/issues/495"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-mail",
          "vendor": "wneessen",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.7.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user\u0027s code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T22:21:02.484Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5"
        },
        {
          "name": "https://github.com/wneessen/go-mail/issues/495",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wneessen/go-mail/issues/495"
        },
        {
          "name": "https://github.com/wneessen/go-mail/pull/496",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wneessen/go-mail/pull/496"
        },
        {
          "name": "https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479"
        }
      ],
      "source": {
        "advisory": "GHSA-wpwj-69cm-q9c5",
        "discovery": "UNKNOWN"
      },
      "title": "go-mail has insufficient address encoding when passing mail addresses to the SMTP client"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59937",
    "datePublished": "2025-09-29T22:21:02.484Z",
    "dateReserved": "2025-09-23T14:33:49.505Z",
    "dateUpdated": "2025-09-30T14:44:35.194Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-59937",
      "date": "2026-10-17",
      "epss": "0.00542",
      "percentile": "0.44331"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "go-mail",
                "vendor": "wneessen",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.7.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:pebcak:go-mail:*:*:*:*:*:go:*:*",
                    "matchCriteriaId": "EF532C2D-4F79-4290-B7D9-3677AB70A758",
                    "versionEndExcluding": "0.7.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user\u0027s code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1"
          },
          {
            "lang": "es",
            "value": "go-mail es una completa biblioteca para enviar correos con Go. En las versiones 0.7.0 e inferiores, debido a un manejo incorrecto de los valores de mail.Address cuando una direcci\u00f3n de remitente o destinatario se pasa a los comandos MAIL FROM o RCPT TO correspondientes del cliente SMTP, existe la posibilidad de un enrutamiento de direcci\u00f3n incorrecto o incluso contrabando de par\u00e1metros ESMTP. Para una explotaci\u00f3n exitosa, se requiere que el c\u00f3digo del usuario permita la entrada arbitraria de direcciones de correo (es decir, a trav\u00e9s de un formulario web o similar). Si solo se utilizan direcciones de correo est\u00e1ticas (es decir, en un archivo de configuraci\u00f3n) y las direcciones de correo en uso no consisten en partes locales entre comillas, esto no deber\u00eda afectar a los usuarios. Este problema est\u00e1 solucionado en la versi\u00f3n 0.7.1"
          }
        ],
        "id": "CVE-2025-59937",
        "lastModified": "2026-10-09T09:10:00.213",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-59937",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-30T14:43:56.630417Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-29T23:15:31.807",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Issue Tracking"
            ],
            "url": "https://github.com/wneessen/go-mail/issues/495"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/wneessen/go-mail/pull/496"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Issue Tracking"
            ],
            "url": "https://github.com/wneessen/go-mail/issues/495"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-88"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-88"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-09-30T22:46:04+00:00",
      "cve": "CVE-2025-59937",
      "id": "CVE-2025-59937",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "go-mail has insufficient address encoding when passing mail addresses to the SMTP client",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59937.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-59937",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-09-30T14:43:56.630417Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-09-30T14:44:28.447Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/wneessen/go-mail/issues/495"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "go-mail",
              "vendor": "wneessen",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.7.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user\u0027s code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1"
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-88",
                  "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-09-29T22:21:02.484Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5"
            },
            {
              "name": "https://github.com/wneessen/go-mail/issues/495",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/wneessen/go-mail/issues/495"
            },
            {
              "name": "https://github.com/wneessen/go-mail/pull/496",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/wneessen/go-mail/pull/496"
            },
            {
              "name": "https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479"
            }
          ],
          "source": {
            "advisory": "GHSA-wpwj-69cm-q9c5",
            "discovery": "UNKNOWN"
          },
          "title": "go-mail has insufficient address encoding when passing mail addresses to the SMTP client"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-59937",
        "datePublished": "2025-09-29T22:21:02.484Z",
        "dateReserved": "2025-09-23T14:33:49.505Z",
        "dateUpdated": "2025-09-30T14:44:35.194Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-59937

Vulnerability from fkie_nvd - Published: 2025-09-29 23:15 - Updated: 2026-10-09 09:10

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479	Patch
security-advisories@github.com	https://github.com/wneessen/go-mail/issues/495	Exploit, Issue Tracking
security-advisories@github.com	https://github.com/wneessen/go-mail/pull/496	Issue Tracking, Patch
security-advisories@github.com	https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/wneessen/go-mail/issues/495	Exploit, Issue Tracking

Impacted products

	Vendor	Product	Version
	pebcak	go-mail	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "go-mail",
          "vendor": "wneessen",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.7.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pebcak:go-mail:*:*:*:*:*:go:*:*",
              "matchCriteriaId": "EF532C2D-4F79-4290-B7D9-3677AB70A758",
              "versionEndExcluding": "0.7.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user\u0027s code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1"
    },
    {
      "lang": "es",
      "value": "go-mail es una completa biblioteca para enviar correos con Go. En las versiones 0.7.0 e inferiores, debido a un manejo incorrecto de los valores de mail.Address cuando una direcci\u00f3n de remitente o destinatario se pasa a los comandos MAIL FROM o RCPT TO correspondientes del cliente SMTP, existe la posibilidad de un enrutamiento de direcci\u00f3n incorrecto o incluso contrabando de par\u00e1metros ESMTP. Para una explotaci\u00f3n exitosa, se requiere que el c\u00f3digo del usuario permita la entrada arbitraria de direcciones de correo (es decir, a trav\u00e9s de un formulario web o similar). Si solo se utilizan direcciones de correo est\u00e1ticas (es decir, en un archivo de configuraci\u00f3n) y las direcciones de correo en uso no consisten en partes locales entre comillas, esto no deber\u00eda afectar a los usuarios. Este problema est\u00e1 solucionado en la versi\u00f3n 0.7.1"
    }
  ],
  "id": "CVE-2025-59937",
  "lastModified": "2026-10-09T09:10:00.213",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59937",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-09-30T14:43:56.630417Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-29T23:15:31.807",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "url": "https://github.com/wneessen/go-mail/issues/495"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/wneessen/go-mail/pull/496"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "url": "https://github.com/wneessen/go-mail/issues/495"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-WPWJ-69CM-Q9C5

Vulnerability from github – Published: 2025-09-29 16:28 – Updated: 2025-11-05 22:01

Summary

go-mail has insufficient address encoding when passing mail addresses to the SMTP client

Details

Impact

Due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, this could lead to a possible wrong address routing or even to ESMTP parameter smuggling.

Vulnerability details

Instead of making use of the String() method of mail.Address, which takes care of proper escaping and quotation of mail address, we used the Address value of the mail.Address which is the raw value when passing it to our SMTP client.

This meant, if a mail address like this was set: "toni.tester@example.com> ORCPT=admin@admin.com"@example.com for a sender or recipient, instead of the correctly quoted/escaped address, the SMTP client would get the raw value passed which would translate into something like this being passed to the SMTP server: RCPT TO:<toni.tester@example.com> ORCPT=admin@admin.com@example.com>.

Since ORCTP is a valid command for the SMTP server, the mail would be routed to the wrong address. Additionally, other SMTP commands could potientially be smuggled in using this method causing unexpected behaviour.

Exploitation requirements

For successful exploitation of this vulnerability it is required that the user's code is allowing for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect your code.

Patches

The vulnerability has been fixed with PR #496 and the fix has been shipped with the go-mail v0.7.1 release.

Issue #495 holds the full report and discussion.

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/wneessen/go-mail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-59937"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-29T16:28:58Z",
    "nvd_published_at": "2025-09-29T23:15:31Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nDue to incorrect handling of the `mail.Address` values when a sender- or recipient address is passed to the corresponding `MAIL FROM` or `RCPT TO` commands of the SMTP client, this could lead to a possible wrong address routing or even to ESMTP parameter smuggling.\n\n#### Vulnerability details\nInstead of making use of the `String()` method of `mail.Address`, which takes care of proper escaping and quotation of mail address, we used the `Address` value of the `mail.Address` which is the raw value when passing it to our SMTP client.\n\nThis meant, if a mail address like this was set: `\"toni.tester@example.com\u003e ORCPT=admin@admin.com\"@example.com` for a sender or recipient, instead of the correctly quoted/escaped address, the SMTP client would get the raw value passed which would translate into something like this being passed to the SMTP server: `RCPT TO:\u003ctoni.tester@example.com\u003e ORCPT=admin@admin.com@example.com\u003e`. \n\nSince ORCTP is a valid command for the SMTP server, the mail would be routed to the wrong address. Additionally, other SMTP commands could potientially be smuggled in using this method causing unexpected behaviour.\n\n#### Exploitation requirements\nFor successful exploitation of this vulnerability it is required that the user\u0027s code is allowing for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect your code.\n\n### Patches\nThe vulnerability has been fixed with PR #496 and the fix has been shipped with the go-mail v0.7.1 release.\n\nIssue #495 holds the full report and discussion.",
  "id": "GHSA-wpwj-69cm-q9c5",
  "modified": "2025-11-05T22:01:58Z",
  "published": "2025-09-29T16:28:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59937"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wneessen/go-mail/issues/495"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wneessen/go-mail/pull/496"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wneessen/go-mail"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3988"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "go-mail has insufficient address encoding when passing mail addresses to the SMTP client"
}

OPENSUSE-SU-2025:15710-1

Vulnerability from csaf_opensuse - Published: 2025-11-07 00:00 - Updated: 2026-09-20 21:44

Summary

govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

Severity

Moderate

Scope

70 vulnerabilities in this advisory, including CVE-2025-59937.

CVE-2025-59937

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-59937 (GCVE-0-2025-59937)

FKIE_CVE-2025-59937

GHSA-WPWJ-69CM-Q9C5

Impact

Vulnerability details

Exploitation requirements

Patches

OPENSUSE-SU-2025:15710-1

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour