CVE-2025-59937 Details
Description
go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1
A vulnerability exists in the go-mail library, specifically in versions prior to 0.7.1, due to improper handling of mail addresses when they are passed to the SMTP client's MAIL FROM or RCPT TO commands. This flaw can lead to misrouting of email or ESMTP parameter smuggling. The issue arises because the library uses the raw address value instead of the properly formatted string, allowing for injection of additional SMTP commands. Exploitation requires the ability to input arbitrary email addresses, such as through a web form.
Users can update to go-mail version 0.7.1, which addresses this vulnerability by correcting the way mail addresses are parsed and formatted for SMTP commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wneessen/go-mail/issues/495 | CISA-ADP | ExploitIssue Tracking |
| https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479 | [email protected] | Patch |
| https://github.com/wneessen/go-mail/issues/495 | [email protected] | ExploitIssue Tracking |
| https://github.com/wneessen/go-mail/pull/496 | [email protected] | Issue TrackingPatch |
| https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pebcak go-mail | < 0.7.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | Initial Analysis | [email protected] |
| Sep 30, 2025 | CVE Modified | CISA-ADP |
| Sep 29, 2025 | New CVE Received | [email protected] |