Netty netty-codec-smtp SMTP cmd-name not CRLF-validated Vulnerability
CVE-2026-93576 Published on September 18, 2026

Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)
Netty netty-codec-smtp SMTP command-name field is not CRLF-validated (incomplete fix of CVE-2025-59419)

NVD

Vulnerability Analysis

CVE-2026-93576 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public.

Weakness Type

What is a CRLF Injection Vulnerability?

The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

CVE-2026-93576 has been classified to as a CRLF Injection vulnerability or weakness.


Products Associated with CVE-2026-93576

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Camel Spring Boot
 
Red Hat Jboss Fuse
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Single Sign On
 

Affected Versions

Red Hat build of Apache Camel for Spring Boot 4: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat Single Sign-On 7: