CVE-2025-59937: go-mail has insufficient address encoding when passing mail addresses to the SMTP client

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-29 · updated 2026-10-09
Weakness: CWE-88

Description

go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1

Affected products

wneessen go-mail: before 0.7.1 — fixed in 0.7.1

How to fix

Upgrade to a fixed version: wneessen go-mail 0.7.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-59937 or the next vulnerability affects your stack