{"action":"Upgrade io.netty:netty-codec-smtp to 4.1.128.Final (4.1.x) or 4.2.7.Final (4.2.x) or later.","affected":[{"fixed":"4.2.7.Final","introduced":"4.2.0.Alpha1"},{"fixed":"4.1.128.Final","introduced":"0"}],"component":"io.netty:netty-codec-smtp","cve_ids":["CVE-2025-59419"],"ecosystem":"Maven","epss":0.01553,"exploited":false,"fixed_versions":["4.2.7.Final","4.1.128.Final"],"ghsa_id":"GHSA-jq43-27x9-3v86","id":"tcs_01M5N93EKF395QB93A2YKBNGWA","modified_at":"2026-09-10T03:50:29.967090066Z","published_at":"2025-10-15T17:12:55Z","references":["https://osv.dev/vulnerability/GHSA-jq43-27x9-3v86","https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86","https://nvd.nist.gov/vuln/detail/CVE-2025-59419","https://github.com/netty/netty/commit/1782e8c2060a244c4d4e6f9d9112d5517ca05120","https://github.com/netty/netty/commit/2b3fddd3339cde1601f622b9ce5e54c39f24c3f9","https://gist.github.com/DepthFirstDisclosures/ddacca28cb94b48fa8ab998cef59ed8c","https://github.com/netty/netty","https://www.depthfirst.com/post/our-ai-agent-found-a-netty-zero-day-that-bypasses-email-authentication-the-story-of-cve-2025-59419"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-jq43-27x9-3v86","url":"https://osv.dev/vulnerability/GHSA-jq43-27x9-3v86"},{"source":"nvd","source_id":"CVE-2025-59419","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59419"}],"summary":"Netty has SMTP Command Injection Vulnerability that Allows Email Forgery"}