{
  "cveId": "CVE-2025-59419",
  "url": "https://patchblox.com/security/cve/CVE-2025-59419",
  "summary": "CVE-2025-59419 is fixed in 3 products on 1 platform, first by libnetty-java 1:4.1.7-4ubuntu0.1\u002Besm4, released October 15, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libnetty-java: Netty is an asynchronous, event-driven network application framework",
  "description": "Netty is an asynchronous, event-driven network application framework. Inversions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Nettycontains an SMTP command injection vulnerability due to insufficient inputvalidation for Carriage Return (\\r) and Line Feed (\\n) characters inuser-supplied parameters. The vulnerability exists inio.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters aredirectly concatenated into the SMTP command string without sanitization.When methods such as SmtpRequests.rcpt(recipient) are called with amalicious string containing CRLF sequences, attackers can inject arbitrarySMTP commands. Because the injected commands are sent from the server\u0027strusted IP address, resulting emails will likely pass SPF and DKIMauthentication checks, making them appear legitimate. This allows remoteattackers who can control SMTP command parameters (such as emailrecipients) to forge arbitrary emails from the trusted server, potentiallyimpersonating executives and forging high-stakes corporate communications.This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. Noknown workarounds exist.",
  "published": "2025-10-15T09:15:00Z",
  "severity": "Medium",
  "epss": 0.01553,
  "epssPercentile": 0.75304,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:4.1.7-4ubuntu0.1\u002Besm4",
      "fix": "libnetty-java 1:4.1.7-4ubuntu0.1\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libnetty-java-1-4.1.7-4ubuntu0.1-esm4",
      "released": "2025-10-15T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:4.1.45-1ubuntu0.1~esm3",
      "fix": "libnetty-java 1:4.1.45-1ubuntu0.1~esm3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libnetty-java-1-4.1.45-1ubuntu0.1-esm3",
      "released": "2025-10-15T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:4.1.48-4\u002Bdeb11u2ubuntu0.1~esm2",
      "fix": "libnetty-java 1:4.1.48-4\u002Bdeb11u2ubuntu0.1~esm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libnetty-java-1-4.1.48-4-deb11u2ubuntu0.1-esm2",
      "released": "2025-10-15T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1:4.1.48-9ubuntu0.1~esm2",
      "fix": "libnetty-java 1:4.1.48-9ubuntu0.1~esm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libnetty-java-1-4.1.48-9ubuntu0.1-esm2",
      "released": "2025-10-15T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "1:4.1.48-10ubuntu0.25.04.1",
      "fix": "libnetty-java 1:4.1.48-10ubuntu0.25.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libnetty-java-1-4.1.48-10ubuntu0.25.04.1",
      "released": "2026-01-16T01:42:25Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "1:4.1.48-10ubuntu0.25.10.1",
      "fix": "libnetty-java 1:4.1.48-10ubuntu0.25.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-libnetty-java-1-4.1.48-10ubuntu0.25.10.1",
      "released": "2025-10-15T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1:4.1.48-7\u002Bdeb12u2",
      "fix": "DEBIAN-CVE-2025-59419",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-59419",
      "released": "2025-10-15T16:15:35Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:4.1.48-10\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2025-59419",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-59419",
      "released": "2025-10-15T16:15:35Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "Debian 14",
      "fixedVersion": "1:4.1.48-11",
      "fix": "DEBIAN-CVE-2025-59419",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-59419",
      "released": "2025-10-15T16:15:35Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "4.1.128-150200.4.37.1",
      "fix": "SUSE-SU-2025:4087-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4087-1",
      "released": "2025-11-12T19:35:11Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "sles 15.6",
      "fixedVersion": "4.1.128-150200.4.37.1",
      "fix": "SUSE-SU-2025:4087-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4087-1",
      "released": "2025-11-12T19:35:11Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "sles 15.7",
      "fixedVersion": "4.1.128-150200.4.37.1",
      "fix": "SUSE-SU-2025:4087-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4087-1",
      "released": "2025-11-12T19:35:11Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.0.74-150200.3.33.1",
      "fix": "SUSE-SU-2025:4087-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4087-1",
      "released": "2025-11-12T19:35:11Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "sles 15.6",
      "fixedVersion": "2.0.74-150200.3.33.1",
      "fix": "SUSE-SU-2025:4087-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4087-1",
      "released": "2025-11-12T19:35:11Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "sles 15.7",
      "fixedVersion": "2.0.74-150200.3.33.1",
      "fix": "SUSE-SU-2025:4087-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4087-1",
      "released": "2025-11-12T19:35:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}