PT-2025-39914 · Go-Mail · Go-Mail

Xclow3N · Published 2025-09-29 · Updated 2025-11-07 · CVE-2025-59937

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions go-mail versions 0.7.0 and below

Description The go-mail library improperly handles mail.Address values when passed to the SMTP client’s MAIL FROM or RCPT TO commands. This can lead to incorrect address routing or ESMTP parameter smuggling. Successful exploitation requires the user’s code to allow arbitrary mail address input. The issue stems from using the raw Address value instead of the String() method, which properly escapes and quotes mail addresses. Specifically, a crafted mail address like "[e-mail]> ORCPT=[e-mail]"@example.com could be misinterpreted by the SMTP server, potentially routing mail to unintended recipients or allowing the injection of additional SMTP commands.

Recommendations Update to version 0.7.1 or later.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2025-59937

GHSA-WPWJ-69CM-Q9C5

GO-2025-3988

OPENSUSE-SU-2025:15710-1

Affected Products

Go-Mail

References · 85

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59937.json · Exploit
• 🔥 https://github.com/wneessen/go-mail/issues/495 · Exploit
• https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5 · Vendor Advisory
• https://github.com/wneessen/go-mail/pull/496 · Patch
• https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479 · Patch
• https://osv.dev/vulnerability/GO-2025-3988 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59937 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wpwj-69cm-q9c5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59937 · Security Note
• https://github.com/wneessen/go-mail · Note
• https://suse.com/security/cve/CVE-2025-58073 · Note
• https://suse.com/security/cve/CVE-2016-11067 · Note
• https://suse.com/security/cve/CVE-2016-11078 · Note
• https://suse.com/security/cve/CVE-2025-59043 · Note