# CVE-2025-59419: libnetty-java: Netty is an asynchronous, event-driven network application framework CVE-2025-59419 is fixed in 3 products on 1 platform, first by libnetty-java 1:4.1.7-4ubuntu0.1+esm4, released October 15, 2025. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2025-59419 - Priority: Routine - CVSS: n/a (Medium) - EPSS: 0.0155 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 15, 2025 ## Description Netty is an asynchronous, event-driven network application framework. Inversions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Nettycontains an SMTP command injection vulnerability due to insufficient inputvalidation for Carriage Return (\r) and Line Feed (\n) characters inuser-supplied parameters. The vulnerability exists inio.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters aredirectly concatenated into the SMTP command string without sanitization.When methods such as SmtpRequests.rcpt(recipient) are called with amalicious string containing CRLF sequences, attackers can inject arbitrarySMTP commands. Because the injected commands are sent from the server'strusted IP address, resulting emails will likely pass SPF and DKIMauthentication checks, making them appear legitimate. This allows remoteattackers who can control SMTP command parameters (such as emailrecipients) to forge arbitrary emails from the trusted server, potentiallyimpersonating executives and forging high-stakes corporate communications.This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. Noknown workarounds exist. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libnetty-java Ubuntu 18.04.6 LTS (bionic) | 1:4.1.7-4ubuntu0.1+esm4 | [libnetty-java 1:4.1.7-4ubuntu0.1+esm4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libnetty-java-1-4.1.7-4ubuntu0.1-esm4.md) | Oct 15, 2025 | | Linux | libnetty-java Ubuntu 20.04 LTS (focal) | 1:4.1.45-1ubuntu0.1~esm3 | [libnetty-java 1:4.1.45-1ubuntu0.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libnetty-java-1-4.1.45-1ubuntu0.1-esm3.md) | Oct 15, 2025 | | Linux | libnetty-java Ubuntu 22.04.1 LTS (jammy) | 1:4.1.48-4+deb11u2ubuntu0.1~esm2 | [libnetty-java 1:4.1.48-4+deb11u2ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libnetty-java-1-4.1.48-4-deb11u2ubuntu0.1-esm2.md) | Oct 15, 2025 | | Linux | libnetty-java Ubuntu 24.04.5 LTS (noble) | 1:4.1.48-9ubuntu0.1~esm2 | [libnetty-java 1:4.1.48-9ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libnetty-java-1-4.1.48-9ubuntu0.1-esm2.md) | Oct 15, 2025 | | Linux | libnetty-java Ubuntu 25.04 (plucky) | 1:4.1.48-10ubuntu0.25.04.1 | [libnetty-java 1:4.1.48-10ubuntu0.25.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libnetty-java-1-4.1.48-10ubuntu0.25.04.1.md) | Jan 16, 2026 | | Linux | libnetty-java Ubuntu 25.10 (questing) | 1:4.1.48-10ubuntu0.25.10.1 | [libnetty-java 1:4.1.48-10ubuntu0.25.10.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libnetty-java-1-4.1.48-10ubuntu0.25.10.1.md) | Oct 15, 2025 | | Linux | netty Debian 12.15 (bookworm) | 1:4.1.48-7+deb12u2 | [DEBIAN-CVE-2025-59419](https://patchblox.com/security/data/fix/linux/debian-cve-2025-59419.md) | Oct 15, 2025 | | Linux | netty Debian 13.5 (trixie) | 1:4.1.48-10+deb13u1 | [DEBIAN-CVE-2025-59419](https://patchblox.com/security/data/fix/linux/debian-cve-2025-59419.md) | Oct 15, 2025 | | Linux | netty Debian 14 | 1:4.1.48-11 | [DEBIAN-CVE-2025-59419](https://patchblox.com/security/data/fix/linux/debian-cve-2025-59419.md) | Oct 15, 2025 | | Linux | netty opensuse-leap 15.6 | 4.1.128-150200.4.37.1 | [SUSE-SU-2025:4087-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4087-1.md) | Nov 12, 2025 | | Linux | netty sles 15.6 | 4.1.128-150200.4.37.1 | [SUSE-SU-2025:4087-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4087-1.md) | Nov 12, 2025 | | Linux | netty sles 15.7 | 4.1.128-150200.4.37.1 | [SUSE-SU-2025:4087-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4087-1.md) | Nov 12, 2025 | | Linux | netty-tcnative opensuse-leap 15.6 | 2.0.74-150200.3.33.1 | [SUSE-SU-2025:4087-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4087-1.md) | Nov 12, 2025 | | Linux | netty-tcnative sles 15.6 | 2.0.74-150200.3.33.1 | [SUSE-SU-2025:4087-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4087-1.md) | Nov 12, 2025 | | Linux | netty-tcnative sles 15.7 | 2.0.74-150200.3.33.1 | [SUSE-SU-2025:4087-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4087-1.md) | Nov 12, 2025 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.