{"id":"GHSA-wpwj-69cm-q9c5","revision":"4bd2dbf49c424e45b1eeabae894db69c","records":[{"revision":"4bd2dbf49c424e45b1eeabae894db69c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-wpwj-69cm-q9c5","aliases":["CVE-2025-59937","GO-2025-3988"],"title":"go-mail has insufficient address encoding when passing mail addresses to the SMTP client","description":"### Impact\nDue to incorrect handling of the `mail.Address` values when a sender- or recipient address is passed to the corresponding `MAIL FROM` or `RCPT TO` commands of the SMTP client, this could lead to a possible wrong address routing or even to ESMTP parameter smuggling.\n\n#### Vulnerability details\nInstead of making use of the `String()` method of `mail.Address`, which takes care of proper escaping and quotation of mail address, we used the `Address` value of the `mail.Address` which is the raw value when passing it to our SMTP client.\n\nThis meant, if a mail address like this was set: `\"toni.tester@example.com> ORCPT=admin@admin.com\"@example.com` for a sender or recipient, instead of the correctly quoted/escaped address, the SMTP client would get the raw value passed which would translate into something like this being passed to the SMTP server: `RCPT TO:<toni.tester@example.com> ORCPT=admin@admin.com@example.com>`. \n\nSince ORCTP is a valid command for the SMTP server, the mail would be routed to the wrong address. Additionally, other SMTP commands could potientially be smuggled in using this method causing unexpected behaviour.\n\n#### Exploitation requirements\nFor successful exploitation of this vulnerability it is required that the user's code is allowing for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect your code.\n\n### Patches\nThe vulnerability has been fixed with PR #496 and the fix has been shipped with the go-mail v0.7.1 release.\n\nIssue #495 holds the full report and discussion.","state":0,"publishedAt":"2025-09-29T16:28:58+00:00","modifiedAt":"2026-09-10T03:50:28.9633325+00:00","affected":[{"ecosystem":"Go","name":"github.com/wneessen/go-mail","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.7.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5","https://nvd.nist.gov/vuln/detail/CVE-2025-59937","https://github.com/wneessen/go-mail/issues/495","https://github.com/wneessen/go-mail/pull/496","https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479","https://github.com/wneessen/go-mail","https://pkg.go.dev/vuln/GO-2025-3988"],"sourceUrl":"https://github.com/advisories/GHSA-wpwj-69cm-q9c5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wpwj-69cm-q9c5","identifiers":["GHSA-wpwj-69cm-q9c5","CVE-2025-59937","GO-2025-3988"]},"retained":false,"historicalAffected":[]}],"coverage":[]}