CVE-2026-93576

Name of the Vulnerable Software and Affected Versions netty-codec-smtp versions prior to 4.1.138-1.1

Description Netty netty-codec-smtp fails to properly validate Carriage Return (CR) and Line Feed (LF) characters within the SMTP command-name field. If an application passes untrusted input into this field, a remote attacker can inject CR/LF characters to execute arbitrary SMTP commands. This leads to SMTP command smuggling, which may enable unauthorized email relay or the spoofing of sender and recipient addresses.

Recommendations Update to version 4.1.138-1.1.