CVE-2025-59937
go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1
- CVSS 4.0
- 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-25)
- CWE
- CWE-88
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pebcak:go-mail
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wpwj-69cm-q9c5 | Go | github.com/wneessen/go-mail | <0.7.1 | 0.7.1 |
| GO-2025-3988 | Go | github.com/wneessen/go-mail | <0.7.1 | 0.7.1 |