Skip to content
OpenAdvisories
Medium USN-7843-1 1 CVE

netty vulnerability

Published Oct 28, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Netty did not properly handle user input. A remote
attacker could possibly use this issue to forge arbitrary emails from a
trusted server.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 25.10 netty 1:4.1.48-10ubuntu0.25.10.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS netty 1:4.1.7-4ubuntu0.1+esm4
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS netty 1:4.1.45-1ubuntu0.1~esm3
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS netty 1:4.1.48-4+deb11u2ubuntu0.1~esm2
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS netty 1:4.1.48-9ubuntu0.1~esm2

Vulnerabilities 1

  • Medium 5.5
    CVE-2025-59419

    Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) an…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

References

  • report
    https://ubuntu.com/security/CVE-2025-59419