Medium severityOSV Advisory· Published Oct 15, 2025· Updated Apr 15, 2026

CVE-2025-59419

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerability exists in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string without sanitization. When methods such as SmtpRequests.rcpt(recipient) are called with a malicious string containing CRLF sequences, attackers can inject arbitrary SMTP commands. Because the injected commands are sent from the server's trusted IP address, resulting emails will likely pass SPF and DKIM authentication checks, making them appear legitimate. This allows remote attackers who can control SMTP command parameters (such as email recipients) to forge arbitrary emails from the trusted server, potentially impersonating executives and forging high-stakes corporate communications. This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. No known workarounds exist.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.netty:netty-codec-smtpMaven	>= 4.2.0.Alpha1, < 4.2.7.Final	4.2.7.Final
io.netty:netty-codec-smtpMaven	< 4.1.128.Final	4.1.128.Final

Affected products

Netty/NettyOSV
Range: netty-4.0.0.Alpha1, netty-4.0.0.Alpha2, netty-4.0.0.Alpha3, …

Patches

afae49cd621a

[maven-release-plugin] prepare release netty-4.1.128.Final

https://github.com/netty/nettyNetty Project BotOct 14, 2025via osv

commit

47 files changed · +49 −49

all/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-all</artifactId>

bom/pom.xml+2 −2 modified

@@ -25,7 +25,7 @@
 
   <groupId>io.netty</groupId>
   <artifactId>netty-bom</artifactId>
-  <version>4.1.128.Final-SNAPSHOT</version>
+  <version>4.1.128.Final</version>
   <packaging>pom</packaging>
 
   <name>Netty/BOM</name>
@@ -49,7 +49,7 @@
     <url>https://github.com/netty/netty</url>
     <connection>scm:git:git://github.com/netty/netty.git</connection>
     <developerConnection>scm:git:ssh://git@github.com/netty/netty.git</developerConnection>
-    <tag>HEAD</tag>
+    <tag>netty-4.1.128.Final</tag>
   </scm>
 
   <developers>

buffer/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-buffer</artifactId>

codec-dns/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-dns</artifactId>

codec-haproxy/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-haproxy</artifactId>

codec-http2/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-http2</artifactId>

codec-http/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-http</artifactId>

codec-memcache/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-memcache</artifactId>

codec-mqtt/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-mqtt</artifactId>

codec/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec</artifactId>

codec-redis/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-redis</artifactId>

codec-smtp/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-smtp</artifactId>

codec-socks/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-socks</artifactId>

codec-stomp/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-stomp</artifactId>

codec-xml/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-codec-xml</artifactId>

common/pom.xml+1 −1 modified

@@ -21,7 +21,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-common</artifactId>

dev-tools/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-dev-tools</artifactId>

example/pom.xml+1 −1 modified

@@ -21,7 +21,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-example</artifactId>

handler/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-handler</artifactId>

handler-proxy/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-handler-proxy</artifactId>

handler-ssl-ocsp/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-handler-ssl-ocsp</artifactId>

microbench/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-microbench</artifactId>

pom.xml+2 −2 modified

@@ -26,7 +26,7 @@
   <groupId>io.netty</groupId>
   <artifactId>netty-parent</artifactId>
   <packaging>pom</packaging>
-  <version>4.1.128.Final-SNAPSHOT</version>
+  <version>4.1.128.Final</version>
 
   <name>Netty</name>
   <url>https://netty.io/</url>
@@ -53,7 +53,7 @@
     <url>https://github.com/netty/netty</url>
     <connection>scm:git:git://github.com/netty/netty.git</connection>
     <developerConnection>scm:git:ssh://git@github.com/netty/netty.git</developerConnection>
-    <tag>HEAD</tag>
+    <tag>netty-4.1.128.Final</tag>
   </scm>
 
   <developers>

resolver-dns-classes-macos/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
   <artifactId>netty-resolver-dns-classes-macos</artifactId>

resolver-dns-native-macos/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
   <artifactId>netty-resolver-dns-native-macos</artifactId>

resolver-dns/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-resolver-dns</artifactId>

resolver/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-resolver</artifactId>

testsuite-autobahn/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-autobahn</artifactId>

testsuite-http2/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-http2</artifactId>

testsuite-native-image-client/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-native-image-client</artifactId>

testsuite-native-image-client-runtime-init/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-native-image-client-runtime-init</artifactId>

testsuite-native-image/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-native-image</artifactId>

testsuite-native/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-native</artifactId>

testsuite-osgi/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-osgi</artifactId>

testsuite/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-testsuite</artifactId>

testsuite-shading/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-shading</artifactId>

transport-blockhound-tests/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-transport-blockhound-tests</artifactId>

transport-classes-epoll/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
   <artifactId>netty-transport-classes-epoll</artifactId>

transport-classes-kqueue/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
   <artifactId>netty-transport-classes-kqueue</artifactId>

transport-native-epoll/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
   <artifactId>netty-transport-native-epoll</artifactId>

transport-native-kqueue/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
   <artifactId>netty-transport-native-kqueue</artifactId>

transport-native-unix-common/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
   <artifactId>netty-transport-native-unix-common</artifactId>

transport-native-unix-common-tests/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
   <artifactId>netty-transport-native-unix-common-tests</artifactId>

transport/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-transport</artifactId>

transport-rxtx/pom.xml+1 −1 modified

@@ -21,7 +21,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-transport-rxtx</artifactId>

transport-sctp/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-transport-sctp</artifactId>

transport-udt/pom.xml+1 −1 modified

@@ -21,7 +21,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.1.128.Final-SNAPSHOT</version>
+    <version>4.1.128.Final</version>
   </parent>
 
   <artifactId>netty-transport-udt</artifactId>

511cbacea64c

[maven-release-plugin] prepare release netty-4.2.7.Final

https://github.com/netty/nettyNetty Project BotOct 14, 2025via osv

commit

62 files changed · +64 −64

all/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-all</artifactId>

bom/pom.xml+2 −2 modified

@@ -25,7 +25,7 @@
 
   <groupId>io.netty</groupId>
   <artifactId>netty-bom</artifactId>
-  <version>4.2.7.Final-SNAPSHOT</version>
+  <version>4.2.7.Final</version>
   <packaging>pom</packaging>
 
   <name>Netty/BOM</name>
@@ -49,7 +49,7 @@
     <url>https://github.com/netty/netty</url>
     <connection>scm:git:git://github.com/netty/netty.git</connection>
     <developerConnection>scm:git:ssh://git@github.com/netty/netty.git</developerConnection>
-    <tag>HEAD</tag>
+    <tag>netty-4.2.7.Final</tag>
   </scm>
 
   <developers>

buffer/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-buffer</artifactId>

codec-base/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-base</artifactId>

codec-classes-quic/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-classes-quic</artifactId>

codec-compression/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-compression</artifactId>

codec-dns/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-dns</artifactId>

codec-haproxy/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-haproxy</artifactId>

codec-http2/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-http2</artifactId>

codec-http3/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-http3</artifactId>

codec-http/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-http</artifactId>

codec-marshalling/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-marshalling</artifactId>

codec-memcache/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-memcache</artifactId>

codec-mqtt/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-mqtt</artifactId>

codec-native-quic/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-native-quic</artifactId>

codec/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec</artifactId>

codec-protobuf/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-protobuf</artifactId>

codec-redis/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-redis</artifactId>

codec-smtp/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-smtp</artifactId>

codec-socks/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-socks</artifactId>

codec-stomp/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-stomp</artifactId>

codec-xml/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-codec-xml</artifactId>

common/pom.xml+1 −1 modified

@@ -21,7 +21,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-common</artifactId>

dev-tools/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-dev-tools</artifactId>

example/pom.xml+1 −1 modified

@@ -21,7 +21,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-example</artifactId>

handler/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-handler</artifactId>

handler-proxy/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-handler-proxy</artifactId>

handler-ssl-ocsp/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-handler-ssl-ocsp</artifactId>

jfr-stub/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-jfr-stub</artifactId>

microbench/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-microbench</artifactId>

pkitesting/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-pkitesting</artifactId>

pom.xml+2 −2 modified

@@ -26,7 +26,7 @@
   <groupId>io.netty</groupId>
   <artifactId>netty-parent</artifactId>
   <packaging>pom</packaging>
-  <version>4.2.7.Final-SNAPSHOT</version>
+  <version>4.2.7.Final</version>
 
   <name>Netty</name>
   <url>https://netty.io/</url>
@@ -53,7 +53,7 @@
     <url>https://github.com/netty/netty</url>
     <connection>scm:git:git://github.com/netty/netty.git</connection>
     <developerConnection>scm:git:ssh://git@github.com/netty/netty.git</developerConnection>
-    <tag>HEAD</tag>
+    <tag>netty-4.2.7.Final</tag>
   </scm>
 
   <developers>

resolver-dns-classes-macos/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-resolver-dns-classes-macos</artifactId>

resolver-dns-native-macos/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-resolver-dns-native-macos</artifactId>

resolver-dns/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-resolver-dns</artifactId>

resolver/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-resolver</artifactId>

testsuite-autobahn/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-autobahn</artifactId>

testsuite-common/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-common</artifactId>

testsuite-http2/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-http2</artifactId>

testsuite-jpms/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-jpms</artifactId>

testsuite-karaf/pom.xml+1 −1 modified

@@ -21,7 +21,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-karaf</artifactId>

testsuite-native-image-client/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-native-image-client</artifactId>

testsuite-native-image-client-runtime-init/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-native-image-client-runtime-init</artifactId>

testsuite-native-image/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-native-image</artifactId>

testsuite-native/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-native</artifactId>

testsuite-osgi/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-osgi</artifactId>

testsuite/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite</artifactId>

testsuite-shading/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-testsuite-shading</artifactId>

transport-blockhound-tests/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-transport-blockhound-tests</artifactId>

transport-classes-epoll/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-transport-classes-epoll</artifactId>

transport-classes-io_uring/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-transport-classes-io_uring</artifactId>

transport-classes-kqueue/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-transport-classes-kqueue</artifactId>

transport-native-epoll/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-transport-native-epoll</artifactId>

transport-native-io_uring/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-transport-native-io_uring</artifactId>

transport-native-kqueue/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-transport-native-kqueue</artifactId>

transport-native-unix-common/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-transport-native-unix-common</artifactId>

transport-native-unix-common-tests/pom.xml+1 −1 modified

@@ -19,7 +19,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
   <artifactId>netty-transport-native-unix-common-tests</artifactId>

transport/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-transport</artifactId>

transport-rxtx/pom.xml+1 −1 modified

@@ -21,7 +21,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-transport-rxtx</artifactId>

transport-sctp/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-transport-sctp</artifactId>

transport-udt/pom.xml+1 −1 modified

@@ -21,7 +21,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-transport-udt</artifactId>

varhandle-stub/pom.xml+1 −1 modified

@@ -20,7 +20,7 @@
   <parent>
     <groupId>io.netty</groupId>
     <artifactId>netty-parent</artifactId>
-    <version>4.2.7.Final-SNAPSHOT</version>
+    <version>4.2.7.Final</version>
   </parent>
 
   <artifactId>netty-varhandle-stub</artifactId>

2b3fddd3339c

Merge commit from fork

https://github.com/netty/nettyDepthFirst DisclosuresOct 14, 2025via ghsa

commit

3 files changed · +119 −0

codec-smtp/src/main/java/io/netty/handler/codec/smtp/DefaultSmtpRequest.java+2 −0 modified

@@ -43,6 +43,7 @@ public DefaultSmtpRequest(SmtpCommand command) {
      */
     public DefaultSmtpRequest(SmtpCommand command, CharSequence... parameters) {
         this.command = ObjectUtil.checkNotNull(command, "command");
+        SmtpUtils.validateSMTPParameters(parameters);
         this.parameters = SmtpUtils.toUnmodifiableList(parameters);
     }
 
@@ -55,6 +56,7 @@ public DefaultSmtpRequest(CharSequence command, CharSequence... parameters) {
 
     DefaultSmtpRequest(SmtpCommand command, List<CharSequence> parameters) {
         this.command = ObjectUtil.checkNotNull(command, "command");
+        SmtpUtils.validateSMTPParameters(parameters);
         this.parameters = parameters != null ?
                 Collections.unmodifiableList(parameters) : Collections.<CharSequence>emptyList();
     }

codec-smtp/src/main/java/io/netty/handler/codec/smtp/SmtpUtils.java+44 −0 modified

@@ -28,5 +28,49 @@ static List<CharSequence> toUnmodifiableList(CharSequence... sequences) {
         return Collections.unmodifiableList(Arrays.asList(sequences));
     }
 
+    /**
+     * Validates SMTP parameters to prevent SMTP command injection.
+     * Throws IllegalArgumentException if any parameter contains CRLF sequences.
+     */
+    static void validateSMTPParameters(CharSequence... parameters) {
+        if (parameters != null) {
+            for (CharSequence parameter : parameters) {
+                if (parameter != null) {
+                    validateSMTPParameter(parameter);
+                }
+            }
+        }
+    }
+
+    /**
+     * Validates SMTP parameters to prevent SMTP command injection.
+     * Throws IllegalArgumentException if any parameter contains CRLF sequences.
+     */
+    static void validateSMTPParameters(List<CharSequence> parameters) {
+        if (parameters != null) {
+            for (CharSequence parameter : parameters) {
+                if (parameter != null) {
+                    validateSMTPParameter(parameter);
+                }
+            }
+        }
+    }
+
+    private static void validateSMTPParameter(CharSequence parameter) {
+        if (parameter instanceof String) {
+            String paramStr = (String) parameter;
+            if (paramStr.indexOf('\r') != -1 || paramStr.indexOf('\n') != -1) {
+                throw new IllegalArgumentException("SMTP parameter contains CRLF characters: " + parameter);
+            }
+        } else {
+            for (int i = 0; i < parameter.length(); i++) {
+                char c = parameter.charAt(i);
+                if (c == '\r' || c == '\n') {
+                    throw new IllegalArgumentException("SMTP parameter contains CRLF characters: " + parameter);
+                }
+            }
+        }
+    }
+
     private SmtpUtils() { }
 }

codec-smtp/src/test/java/io/netty/handler/codec/smtp/SmtpRequestsTest.java+73 −0 added

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2025 The Netty Project
+ *
+ * The Netty Project licenses this file to you under the Apache License,
+ * version 2.0 (the "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at:
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+package io.netty.handler.codec.smtp;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.function.Executable;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+public class SmtpRequestsTest {
+    @Test
+    public void testSmtpInjectionWithCarriageReturn() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.mail("test@example.com\rQUIT");
+            }
+        });
+    }
+
+    @Test
+    public void testSmtpInjectionWithLineFeed() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.mail("test@example.com\nQUIT");
+            }
+        });
+    }
+
+    @Test
+    public void testSmtpInjectionWithCRLF() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.rcpt("test@example.com\r\nQUIT");
+            }
+        });
+    }
+
+    @Test
+    public void testSmtpInjectionInAuthParameter() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.auth("PLAIN", "dGVzdA\rQUIT");
+            }
+        });
+    }
+
+    @Test
+    public void testSmtpInjectionInHelo() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.helo("localhost\r\nQUIT");
+            }
+        });
+    }
+}

1782e8c2060a

Merge commit from fork

https://github.com/netty/nettyDepthFirst DisclosuresOct 14, 2025via ghsa

commit

3 files changed · +119 −0

codec-smtp/src/main/java/io/netty/handler/codec/smtp/DefaultSmtpRequest.java+2 −0 modified

@@ -43,6 +43,7 @@ public DefaultSmtpRequest(SmtpCommand command) {
      */
     public DefaultSmtpRequest(SmtpCommand command, CharSequence... parameters) {
         this.command = ObjectUtil.checkNotNull(command, "command");
+        SmtpUtils.validateSMTPParameters(parameters);
         this.parameters = SmtpUtils.toUnmodifiableList(parameters);
     }
 
@@ -55,6 +56,7 @@ public DefaultSmtpRequest(CharSequence command, CharSequence... parameters) {
 
     DefaultSmtpRequest(SmtpCommand command, List<CharSequence> parameters) {
         this.command = ObjectUtil.checkNotNull(command, "command");
+        SmtpUtils.validateSMTPParameters(parameters);
         this.parameters = parameters != null ?
                 Collections.unmodifiableList(parameters) : Collections.<CharSequence>emptyList();
     }

codec-smtp/src/main/java/io/netty/handler/codec/smtp/SmtpUtils.java+44 −0 modified

@@ -28,5 +28,49 @@ static List<CharSequence> toUnmodifiableList(CharSequence... sequences) {
         return Collections.unmodifiableList(Arrays.asList(sequences));
     }
 
+    /**
+     * Validates SMTP parameters to prevent SMTP command injection.
+     * Throws IllegalArgumentException if any parameter contains CRLF sequences.
+     */
+    static void validateSMTPParameters(CharSequence... parameters) {
+        if (parameters != null) {
+            for (CharSequence parameter : parameters) {
+                if (parameter != null) {
+                    validateSMTPParameter(parameter);
+                }
+            }
+        }
+    }
+
+    /**
+     * Validates SMTP parameters to prevent SMTP command injection.
+     * Throws IllegalArgumentException if any parameter contains CRLF sequences.
+     */
+    static void validateSMTPParameters(List<CharSequence> parameters) {
+        if (parameters != null) {
+            for (CharSequence parameter : parameters) {
+                if (parameter != null) {
+                    validateSMTPParameter(parameter);
+                }
+            }
+        }
+    }
+
+    private static void validateSMTPParameter(CharSequence parameter) {
+        if (parameter instanceof String) {
+            String paramStr = (String) parameter;
+            if (paramStr.indexOf('\r') != -1 || paramStr.indexOf('\n') != -1) {
+                throw new IllegalArgumentException("SMTP parameter contains CRLF characters: " + parameter);
+            }
+        } else {
+            for (int i = 0; i < parameter.length(); i++) {
+                char c = parameter.charAt(i);
+                if (c == '\r' || c == '\n') {
+                    throw new IllegalArgumentException("SMTP parameter contains CRLF characters: " + parameter);
+                }
+            }
+        }
+    }
+
     private SmtpUtils() { }
 }

codec-smtp/src/test/java/io/netty/handler/codec/smtp/SmtpRequestsTest.java+73 −0 added

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2025 The Netty Project
+ *
+ * The Netty Project licenses this file to you under the Apache License,
+ * version 2.0 (the "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at:
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+package io.netty.handler.codec.smtp;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.function.Executable;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+public class SmtpRequestsTest {
+    @Test
+    public void testSmtpInjectionWithCarriageReturn() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.mail("test@example.com\rQUIT");
+            }
+        });
+    }
+
+    @Test
+    public void testSmtpInjectionWithLineFeed() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.mail("test@example.com\nQUIT");
+            }
+        });
+    }
+
+    @Test
+    public void testSmtpInjectionWithCRLF() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.rcpt("test@example.com\r\nQUIT");
+            }
+        });
+    }
+
+    @Test
+    public void testSmtpInjectionInAuthParameter() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.auth("PLAIN", "dGVzdA\rQUIT");
+            }
+        });
+    }
+
+    @Test
+    public void testSmtpInjectionInHelo() {
+        assertThrows(IllegalArgumentException.class, new Executable() {
+            @Override
+            public void execute() {
+                SmtpRequests.helo("localhost\r\nQUIT");
+            }
+        });
+    }
+}

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000