The vulnerability CVE-2026-93576 affects the Netty netty-codec-smtp library, specifically the SMTP command-name field, which is not properly validated for CRLF sequences. This issue is an incomplete fix of the earlier CVE-2025-59419. The improper neutralization of CRLF sequences (CWE-93) can lead to CRLF injection attacks that impact data integrity. The vulnerability is present in the Red Hat build of Apache Camel for Spring Boot 4. Red Hat has provided a vendor advisory referencing remediation guidance and fixed versions available from the upstream Netty project. The CVSS v3.1 score assigned by Red Hat is 7.5 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but high integrity impact.

The vulnerability allows an attacker to modify application data integrity by injecting CRLF sequences into the SMTP command-name field. This can potentially lead to manipulation of SMTP commands or responses, affecting the integrity of communications or data processed by the affected component. There is no impact on confidentiality or availability. No known exploits in the wild have been reported.

Red Hat's advisory points to the upstream Netty project's security advisory (https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p) for fixed versions and remediation guidance. Users should apply the fixes provided by the Netty project to address this vulnerability. Red Hat does not explicitly state a fix availability for their build but references the upstream fix. Patch status is not yet confirmed for Red Hat's build—check the vendor advisory for current remediation guidance. No alternative mitigations are specified by Red Hat.