CVE-2025-59937
Description
go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1
How to fix
- pebcak go-mail0.7.1 or later
- github.com/wneessen/go-mail0.7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pebcak go-mail | v < 0.7.1 | 0.7.1 |
| github.com/wneessen/go-mailGo | v < 0.7.1 | 0.7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.