CVE-2026-93576

Executive Summary

CVE-2026-93576 is an incomplete-fix vulnerability in the Netty netty-codec-smtp module in which the SMTP command-name field is not validated for CRLF sequences, leaving a command-injection surface in applications that embed Netty as an SMTP server or protocol handler. Systems affected are Java applications that expose or bridge SMTP traffic through Netty's SMTP codec and rely on it to sanitize command input; because no upstream patch has been confirmed, deployments remain exposed. With a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), the impact is a high-integrity violation — attackers can inject additional SMTP commands or pipelined protocol data without authentication, while confidentiality and availability are not directly affected.

Technical Analysis

The vulnerability class is CRLF injection / improper neutralization of CRLF sequences (CWE-93, "Improper Neutralization of CRLF Sequences ('CRLF Injection')"). The NVD description states that the SMTP command-name field in netty-codec-smtp is not CRLF-validated, and frames this as an incomplete fix of the earlier CVE-2025-59419. The essential mechanism is therefore a parser-level trust failure: the codec handles the SMTP command line (the verb that follows the start of an SMTP request) and, per the description, does not strip or reject embedded CR (0x0D) and LF (0x0A) bytes in the command-name field. Because SMTP is a line-oriented, CRLF-delimited text protocol, an unvalidated command-name token that is permitted to contain a CRLF sequence allows the attacker to terminate the current logical command line early and cause the remainder of the input to be interpreted as an additional command line by either the codec itself or any downstream SMTP handler that re-serializes the value.

Two properties make this consequential for a framework dependency such as Netty. First, netty-codec-smtp is a library module, not an end-user daemon: the actual exposure depends on how an embedding application constructs its pipeline and what it does with decoded SMTP commands. A host that terminates SMTP directly with Netty's codec, or that proxies/gateways SMTP traffic through Netty, inherits the parsing weakness. Second, the fact that this is described as an incomplete fix of CVE-2025-59419 means a prior remediation attempt addressed one variant of the injection (or one field) but left the command-name field insufficiently constrained — a classic pattern in CRLF-injection remediation where the fix is applied to the argument/parameter handling but not to every attacker-controlled token on the line.

Attack surface: the network-reachable SMTP command path — the submission/submission-relay ports typically front-ended by such codecs (25, 587, 465), plus any internal service-to-service path where an upstream component passes attacker-influenced data into a Netty SMTP pipeline. Preconditions are minimal: no authentication is required (PR:N) and no user interaction is needed (UI:N), and the attack vector is network-based (AV:N) with low complexity (AC:L). No public exploit code, PoC, or Nuclei template has been identified in the available data, so the specific byte-level payload shape cannot be confirmed from evidence and is inferred from the vulnerability class only.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-93) and the NVD description. Where specific function names, field names, or endpoints are not present in the source description, the attack is described at the vulnerability-class level rather than fabricating implementation detail.

1. Reconnaissance / target identification. The attacker identifies a service whose SMTP handling is backed by Netty's netty-codec-smtp module. This is typically reconnaissance at the application or library level rather than through direct banner uniqueness: Netty-based SMTP servers often present standard SMTP banners, and fingerprinting depends on the embedding application's configuration. Because Netty is a widely embedded Java networking framework, the primary targeting step is enumerating exposed SMTP-facing services (management ports, submission gateways, notification/mail-relay microservices, or internal bridges) and determining which are Java/Netty-backed. SSH, HTTPS, and container-orchestrator metadata can corroborate the Java/Netty stack when accessible.

2. Triggering the flaw. The attacker opens an SMTP session and crafts a command line in which the command-name field carries an embedded CRLF sequence — that is, the attacker places a carriage-return/line-feed pair inside the portion of the line that the codec treats as the SMTP command verb, rather than only inside the argument/parameter portion that the earlier fix may have sanitized. Per the description, this field is the one that is not CRLF-validated.

3. Payload/execution method at the vulnerability-class level. The injected CRLF terminates the attacker's current command line prematurely, so the trailing bytes are delivered as one or more additional SMTP command lines. The practical effect class is SMTP command injection / request splitting: the attacker can cause the server-side logic to process commands the application did not intend to accept on that line, potentially manipulating session state (for example, advancing the SMTP state machine, altering an in-progress transaction, or injecting additional directives). Because only the class-level mechanism is documented, the exact set of attacker-chosen commands cannot be enumerated here.

4. Post-exploitation impact. CVSS rates integrity impact as High with confidentiality and availability impact as None. Consistent with that, the realistic effect is unauthorized modification of SMTP protocol state and message-transaction metadata through injected commands — for example, causing the server to treat attacker-supplied data as separate commands, which in a mail-relay context can enable protocol-level smuggling behavior or unexpected message handling. The vector does not, per the CVSS subscores, provide a direct path to data disclosure or denial of service within the scope of this CVE.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N decomposes as follows: network-reachable attack surface; low attack complexity; no privileges required; no user interaction; scope unchanged (the vulnerable component is the authorization boundary); no confidentiality impact; high integrity impact; no availability impact. The dominant risk, therefore, is protocol-integrity violation rather than data theft or service disruption.

Business impact concentrates on services where SMTP correctness has security meaning: mail-submission gateways, notification/alerting microservices, application servers that accept inbound SMTP, and internal service meshes where one Netty-backed component forwards SMTP commands to another. In these contexts, injected commands can cause messages to be routed, altered, or interpreted differently than the application intended, undermining message-integrity guarantees and, in gateway scenarios, enabling smuggling-style behavior across a trust boundary. Blast radius is governed by two factors: (a) how many deployed services inherit the netty-codec-smtp module as a transitive dependency, and (b) whether the vulnerable command-name path is reachable from an untrusted network. Because Netty is a common transitive dependency in Java stacks (application servers, RPC frameworks, messaging clients), a single vulnerable version can appear across many services even when SMTP is not an obvious product feature.

Exploitability is tempered by the absence of published exploit code: EPSS has not been scored by FIRST.org, no PoC is known, no Nuclei template exists, and the CVE is not in CISA KEV. The practical priority is consequently "fix when the SMTP command path is network-exposed," with elevated urgency for internet-facing or cross-trust-boundary SMTP gateways.

Detection Guidance

Detection should combine dependency/version inspection, SMTP line-integrity logging, and network-level inspection of SMTP traffic for CRLF sequences inside the command-name token.

Sigma Rule

title: Potential Netty netty-codec-smtp CRLF Command-Name Injection (CVE-2026-93576)
id: 3f1c7a90-8b2e-4d51-9c47-cve202693576
status: experimental
description: Detects SMTP command lines containing embedded CRLF sequences within the command-name token, consistent with CWE-93 exploitation of Netty netty-codec-smtp.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93576
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: smtp
  service: smtp_server
detection:
  selection_crlf:
    message|contains:
      - '\r\n'
      - '%0d%0a'
      - '\\r\\n'
  selection_smtp_verb:
    message|contains:
      - 'MAIL'
      - 'RCPT'
      - 'DATA'
      - 'HELO'
      - 'EHLO'
  condition: selection_crlf and selection_smtp_verb
falsepositives:
  - Legitimate clients transmitting quoted content should never include raw CRLF in the verb position; low FP expected.
level: high
tags:
  - attack.t1190
  - cwe.93

YARA Rule

rule CVE_2026_93576_Netty_SMTP_CRLF_CommandName
{
    meta:
        description = "Detects SMTP command-name data with embedded CRLF sequences targeting Netty netty-codec-smtp (CVE-2026-93576)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93576"
        cve = "CVE-2026-93576"
        cwe = "CWE-93"
        date = "2026-01-01"
    strings:
        $verb1 = "MAIL FROM" ascii nocase
        $verb2 = "RCPT TO" ascii nocase
        $verb3 = "EHLO" ascii nocase
        $verb4 = "HELO" ascii nocase
        $crlf  = { 0D 0A }
    condition:
        (any of ($verb*)) and #crlf > 1
}

Suricata IDS Rule

alert tcp any any -> any [25,465,587] (msg:"CVE-2026-93576 Netty netty-codec-smtp CRLF Command-Name Injection Attempt"; flow:established,to_server; content:"|0D 0A|"; within:16; content:"|0D 0A|"; distance:0; byte_test:1,=,0x0D,0,relative; pcre:"/^(MAIL|RCPT|EHLO|HELO)[^\r\n]*?\r\n\r\n/i"; classtype:attempted-admin; reference:cve,2026-93576; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93576; metadata:created_at 2026_01_01, cve CVE-2026-93576; sid:202693576; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where network.protocol == "smtp" and network.direction == "inbound" and
     process.name : ("java", "java.exe") and
     network.transport == "tcp" and network.destination.port in (25, 465, 587)]
  [network where network.protocol == "smtp" and
     message : "*\\r\\n*" and message : ("MAIL*" or "RCPT*" or "EHLO*" or "HELO*")]

Splunk SPL Query

index=smtp OR index=network sourcetype=stream:smtp OR sourcetype=smtp:server
| eval raw=_raw
| where match(raw, "(?i)(MAIL|RCPT|EHLO|HELO)") AND (match(raw, "(?i)%0d%0a") OR match(raw, "\\r\\n") OR match(raw, "\r\n"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as sources values(dest_port) as dst_ports
        by dest_ip, host
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="smtp,netty,cve-2026-93576,">
  <rule id="2026935" level="12">
    <decoded_as>smtp</decoded_as>
    <match>MAIL|RCPT|EHLO|HELO</match>
    <regex offset="after_match">(%0d%0a|\\r\\n|\r\n)</regex>
    <description>CVE-2026-93576: Possible CRLF injection in SMTP command-name field targeting Netty netty-codec-smtp</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_93576,crlf_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence from any tracked source, no vendor fix listed, no workarounds provided, and no affected version list published. The vulnerability is reported as an incomplete fix of CVE-2025-59419, which means a prior remediation did not cover the command-name field. Treat this as UNPATCHED.

1. Immediate mitigations.

• Determine exposure first: inventory Java services that embed Netty and use netty-codec-smtp, including transitive dependency paths (mvn dependency:tree / Gradle dependency reports), and identify which of those services accept SMTP input from untrusted networks.
• Reduce the attack surface: restrict network reachability to SMTP-facing ports (deny inbound 25/465/587 from the internet where the service is not a public mail gateway), and require authentication and network allow-listing in front of Netty-backed SMTP endpoints using a reverse proxy or mail gateway that performs strict command-line validation before data reaches the Netty pipeline.
• Apply input hardening at the boundary: ensure any front-end proxy or gateway rejects SMTP command lines containing CR or LF in the command-name position, since the codec itself is documented as not performing this validation.
• Closely track CVE-2025-59419, because CVE-2026-93576 is the residual gap after that fix and a corrected full fix is expected to supersede both.

2. Patch/upgrade steps.

• Monitor the Netty project's security advisories and release notes for a corrected netty-codec-smtp release and for the fixed version associated with CVE-2026-93576. No fixed version is recorded in the data provided.
• When a fix lands, upgrade netty-codec-smtp to the corrected release and rebuild all dependent Java services, verifying that the vulnerable transitive version is eliminated across the full dependency graph.
• Re-test the command-name field with CRLF-bearing input after upgrading to confirm the incomplete fix has been completed.

3. Long-term hardening.

• Enforce a dependency-policy gate in CI that flags known-vulnerable Netty modules and blocks builds on unscored/unpatched CVEs in network-facing libraries.
• Adopt centralized, framework-independent SMTP parsing validation (reject control characters in protocol tokens) so that a single codec defect is not the sole control.
• Add the Sigma/YARA/Suricata/Elastic/Splunk/Wazuh detections above to production monitoring and alert on repeated CRLF-in-command-line attempts, which may indicate active probing of CWE-93 exposure.

References

• NVD — CVE-2026-93576: https://nvd.nist.gov/vuln/detail/CVE-2026-93576
• NVD — CVE-2025-59419 (predecessor vulnerability; CVE-2026-93576 is described as an incomplete fix of it): https://nvd.nist.gov/vuln/detail/CVE-2025-59419
• MITRE CWE-93 — Improper Neutralization of CRLF Sequences ('CRLF Injection'): https://cwe.mitre.org/data/definitions/93.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Netty project security advisories and release notes (authoritative source for the eventual fixed netty-codec-smtp version): https://netty.io/news/ and the Netty GitHub security advisory database.

Threat actor / in-the-wild note: No exploit code, PoC, or Nuclei template is known for CVE-2026-93576, EPSS has not been scored by FIRST.org, and the CVE is not listed in CISA KEV. There is no evidence of active exploitation or associated threat-actor campaigns at the time of writing; this assessment should be revisited if a fixed Netty release or public exploit material appears.