{"id":"GO-2025-3988","revision":null,"records":[{"revision":"c25313499c524570bea6c7aac4bf27e7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-59937","aliases":[],"title":"go-mail has insufficient address encoding when passing mail addresses to the SMTP client","description":"go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1","state":0,"publishedAt":"2025-09-29T22:21:02.484+00:00","modifiedAt":"2025-09-30T14:44:35.194+00:00","affected":[{"ecosystem":"Vendor product","name":"go-mail","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"wneessen\",\n                    \"product\": \"go-mail\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.7.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5","https://github.com/wneessen/go-mail/issues/495","https://github.com/wneessen/go-mail/pull/496","https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-59937","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-59937","identifiers":["CVE-2025-59937"]},"retained":false,"historicalAffected":[]},{"revision":"289147e517a34b3590c26812b5d73087","observedAt":"2026-11-09T03:16:01.717+00:00","statement":{"source":"euvd","id":"EUVD-2025-31582","aliases":["CVE-2025-59937","GHSA-wpwj-69cm-q9c5"],"title":"go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands…","description":"go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.2,"severity":null}],"references":["https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5","https://github.com/wneessen/go-mail/issues/495","https://github.com/wneessen/go-mail/pull/496","https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31582","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 29, 2025, 10:21:02 PM","dateUpdated":"Sep 30, 2025, 2:44:35 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15710-1","title":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","vulnerabilityIds":["CVE-2016-11063","CVE-2016-11066","CVE-2016-11067","CVE-2016-11068","CVE-2016-11069","CVE-2016-11070","CVE-2016-11071","CVE-2016-11072","CVE-2016-11073","CVE-2016-11074","CVE-2016-11075","CVE-2016-11076","CVE-2016-11077","CVE-2016-11078","CVE-2016-11079","CVE-2016-11080","CVE-2016-11081","CVE-2016-11082","CVE-2016-11083","CVE-2016-11084","CVE-2017-18872","CVE-2023-32199","CVE-2024-58269","CVE-2025-10545","CVE-2025-10678","CVE-2025-10954","CVE-2025-11374","CVE-2025-11375","CVE-2025-11579","CVE-2025-11621","CVE-2025-12044","CVE-2025-26625","CVE-2025-27093","CVE-2025-41410","CVE-2025-41443","CVE-2025-54286","CVE-2025-54287","CVE-2025-54288","CVE-2025-54289","CVE-2025-54290","CVE-2025-54291","CVE-2025-54293","CVE-2025-54469","CVE-2025-54470","CVE-2025-54471","CVE-2025-54499","CVE-2025-58073","CVE-2025-58075","CVE-2025-58356","CVE-2025-59043","CVE-2025-59048","CVE-2025-59530","CVE-2025-59836","CVE-2025-59937","CVE-2025-61141","CVE-2025-61524","CVE-2025-61581","CVE-2025-61688","CVE-2025-62156","CVE-2025-62157","CVE-2025-62375","CVE-2025-62506","CVE-2025-62513","CVE-2025-62705","CVE-2025-62714","CVE-2025-62725","CVE-2025-62820","CVE-2025-64101","CVE-2025-64102","CVE-2025-64103"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-31582","identifiers":["EUVD-2025-31582","CVE-2025-59937","GHSA-wpwj-69cm-q9c5"]},"retained":false,"historicalAffected":[]},{"revision":"355a49e1a57c46168ca5b0e1cac0dde4","observedAt":"2026-10-25T03:17:27.277+00:00","statement":{"source":"nvd","id":"CVE-2025-59937","aliases":[],"title":"go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands…","description":"go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1","state":0,"publishedAt":"2025-09-29T23:15:31.807+00:00","modifiedAt":"2026-10-09T09:10:00.213+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.2,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479","https://github.com/wneessen/go-mail/issues/495","https://github.com/wneessen/go-mail/pull/496","https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59937","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-88"],"productCriteria":["cpe:2.3:a:pebcak:go-mail:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2025-09-29T23:15:31.807","lastModified":"2026-10-09T09:10:00.213"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-59937","identifiers":["CVE-2025-59937"]},"retained":false,"historicalAffected":[]},{"revision":"4bd2dbf49c424e45b1eeabae894db69c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-wpwj-69cm-q9c5","aliases":["CVE-2025-59937","GO-2025-3988"],"title":"go-mail has insufficient address encoding when passing mail addresses to the SMTP client","description":"### Impact\nDue to incorrect handling of the `mail.Address` values when a sender- or recipient address is passed to the corresponding `MAIL FROM` or `RCPT TO` commands of the SMTP client, this could lead to a possible wrong address routing or even to ESMTP parameter smuggling.\n\n#### Vulnerability details\nInstead of making use of the `String()` method of `mail.Address`, which takes care of proper escaping and quotation of mail address, we used the `Address` value of the `mail.Address` which is the raw value when passing it to our SMTP client.\n\nThis meant, if a mail address like this was set: `\"toni.tester@example.com> ORCPT=admin@admin.com\"@example.com` for a sender or recipient, instead of the correctly quoted/escaped address, the SMTP client would get the raw value passed which would translate into something like this being passed to the SMTP server: `RCPT TO:<toni.tester@example.com> ORCPT=admin@admin.com@example.com>`. \n\nSince ORCTP is a valid command for the SMTP server, the mail would be routed to the wrong address. Additionally, other SMTP commands could potientially be smuggled in using this method causing unexpected behaviour.\n\n#### Exploitation requirements\nFor successful exploitation of this vulnerability it is required that the user's code is allowing for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect your code.\n\n### Patches\nThe vulnerability has been fixed with PR #496 and the fix has been shipped with the go-mail v0.7.1 release.\n\nIssue #495 holds the full report and discussion.","state":0,"publishedAt":"2025-09-29T16:28:58+00:00","modifiedAt":"2026-09-10T03:50:28.9633325+00:00","affected":[{"ecosystem":"Go","name":"github.com/wneessen/go-mail","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.7.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5","https://nvd.nist.gov/vuln/detail/CVE-2025-59937","https://github.com/wneessen/go-mail/issues/495","https://github.com/wneessen/go-mail/pull/496","https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479","https://github.com/wneessen/go-mail","https://pkg.go.dev/vuln/GO-2025-3988"],"sourceUrl":"https://github.com/advisories/GHSA-wpwj-69cm-q9c5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wpwj-69cm-q9c5","identifiers":["GHSA-wpwj-69cm-q9c5","CVE-2025-59937","GO-2025-3988"]},"retained":false,"historicalAffected":[]},{"revision":"bc1693c62f06468695cf124751ca5f03","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-3988","aliases":["CVE-2025-59937","GHSA-wpwj-69cm-q9c5"],"title":"Insufficient address encoding when passing mail addresses to the SMTP client in github.com/wneessen/go-mail","description":"Insufficient address encoding when passing mail addresses to the SMTP client in github.com/wneessen/go-mail","state":0,"publishedAt":"2025-11-05T18:41:07+00:00","modifiedAt":"2026-02-04T02:51:59.143444+00:00","affected":[{"ecosystem":"Go","name":"github.com/wneessen/go-mail","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.7.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5","https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479","https://github.com/wneessen/go-mail/pull/496","https://github.com/wneessen/go-mail/issues/495"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-3988","license":"OSV · upstream source license applies","key":"osv:GO-2025-3988","identifiers":["GO-2025-3988","CVE-2025-59937","GHSA-wpwj-69cm-q9c5"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T14:21:34.5623772+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T14:21:34.5623772+00:00","lastSuccessAt":"2026-11-10T14:21:34.7231232+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:34.7231242+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-20f5f1620a9c4d3a163610437b9eb63d7be94e16a276e2f8f9cc654892f91ba1","complete":true,"records":421967,"lastAttemptAt":"2026-11-10T14:21:27.5892784+00:00","lastSuccessAt":"2026-11-10T14:21:27.2999239+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.5892784+00:00","snapshotPublishedAt":"2026-11-10T13:30:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-efc28183efe04e138ba7d91d47b051d0","complete":true,"records":13691,"lastAttemptAt":"2026-11-10T14:22:00.6171939+00:00","lastSuccessAt":"2026-11-10T13:22:39.879+00:00","error":null,"lastVerifiedAt":"2026-11-10T13:22:39.879+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13744,"expectedIdentifiers":13744,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T14:21:34.5623772+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T14:21:34.5623772+00:00","lastSuccessAt":"2026-11-10T14:21:34.7238617+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:34.723862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ceb2be395f4e41c0a351a924227b0d53","complete":false,"records":13697,"lastAttemptAt":"2026-11-10T14:21:59.9529002+00:00","lastSuccessAt":"2026-11-10T14:21:59.949+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T14:21:59.949+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13744,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T14:21:27.8480987+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.8480987+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T14:21:27.6400184+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.6400184+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T14:21:34.5248017+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:34.5248017+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-86f40cdda9ca36627f818d0cc8237a8a8c7c22cb687d6747a4ea12bded69e17e","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T14:21:27.7432766+00:00","lastSuccessAt":"2026-11-10T11:25:00.8551311+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.7432766+00:00","snapshotPublishedAt":"2026-11-10T11:03:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}