CVE-2026-93576 is a CRLF injection vulnerability in Netty's netty-codec-smtp component where the SMTP command-name field does not properly validate Carriage Return (CR) and Line Feed (LF) characters. This allows a remote attacker to inject arbitrary SMTP commands if untrusted input is routed into this field, resulting in SMTP command smuggling. The vulnerability can lead to unauthorized email relay or spoofing of sender or recipient addresses. Despite the significant impact, real-world exploitability is considered low due to the uncommon practice of routing user-controlled data into the SMTP command-name field. The vulnerability affects multiple specific versions of Netty as listed, and remediation guidance including fixed versions is available from the vendor.

The vulnerability allows attackers to inject arbitrary SMTP commands remotely, which can lead to unauthorized email relay or spoofing of sender and recipient addresses. This compromises the integrity of SMTP communications. However, the confidentiality and availability impacts are not affected. The real-world risk is reduced because typical applications do not route untrusted input into the SMTP command-name field, limiting exploitability.

Fixed versions and remediation guidance are available from the vendor at https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p. Users should upgrade to these fixed versions to address the vulnerability. Since the vulnerability requires routing untrusted input into the SMTP command-name field, reviewing application design to avoid this practice can also mitigate risk. No vendor advisory states that no action is required or that the issue is already mitigated. Patch status is confirmed as fixed in later versions per the vendor advisory.