GHSA-wpwj-69cm-q9c5

Source

https://github.com/advisories/GHSA-wpwj-69cm-q9c5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-wpwj-69cm-q9c5/GHSA-wpwj-69cm-q9c5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wpwj-69cm-q9c5

Aliases

CVE-2025-59937

Published

2025-09-29T16:28:58Z

Modified

2025-09-30T15:15:13Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

go-mail has insufficient address encoding when passing mail addresses to the SMTP client

Details

Impact

Due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, this could lead to a possible wrong address routing or even to ESMTP parameter smuggling.

Vulnerability details

Instead of making use of the String() method of mail.Address, which takes care of proper escaping and quotation of mail address, we used the Address value of the mail.Address which is the raw value when passing it to our SMTP client.

This meant, if a mail address like this was set: "toni.tester@example.com> ORCPT=admin@admin.com"@example.com for a sender or recipient, instead of the correctly quoted/escaped address, the SMTP client would get the raw value passed which would translate into something like this being passed to the SMTP server: RCPT TO:<toni.tester@example.com> ORCPT=admin@admin.com@example.com>.

Since ORCTP is a valid command for the SMTP server, the mail would be routed to the wrong address. Additionally, other SMTP commands could potientially be smuggled in using this method causing unexpected behaviour.

Exploitation requirements

For successful exploitation of this vulnerability it is required that the user's code is allowing for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect your code.

Patches

The vulnerability has been fixed with PR #496 and the fix has been shipped with the go-mail v0.7.1 release.

Issue #495 holds the full report and discussion.

Database specific

{
    "severity": "HIGH",
    "nvd_published_at": "2025-09-29T23:15:31Z",
    "github_reviewed_at": "2025-09-29T16:28:58Z",
    "cwe_ids": [
        "CWE-88"
    ],
    "github_reviewed": true
}

References

Affected packages

Go / github.com/wneessen/go-mail

Package

Name: github.com/wneessen/go-mail; View open source insights on deps.dev
Purl: pkg:golang/github.com/wneessen/go-mail

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.7.1