Skip to content
fr Sign in
7.5 High

CVE-2026-93576 A flaw was found in Netty netty-codec-smtp

Description

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat Single Sign-On 7 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat build of Apache Camel for Spring Boot 4

The 106 CVEs of Red Hat build of Apache Camel for Spring Boot 4 →
CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow 6.5 Medium CVE-2026-114370 A flaw was found in the PathResourceManager component of the Undertow web server 3.7 Low CVE-2026-93562 A flaw was found in Netty's HTTP/1 decoder 6.5 Medium CVE-2026-93574 A flaw was found in Netty's `netty-codec-http` component 6.5 Medium
Track this CVE