Vulnerability in Netty
CVE-2025-59419
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Car…
Vulnerability class: CRLF Injection
EPSS: 0.016 (73.0th percentile) — read the EPSS interpretation.
Affected products
- Netty — versions < 4.2.7.Final, >= 4.2.0.Alpha1, < 4.1.128.Final
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-59419?
- CVE-2025-59419 is a vulnerability in Netty, classified under CRLF Injection. Published 2025-10-15.
- Is CVE-2025-59419 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.