Vulnerability · Published Sep 29, 2025 · Assigned by GitHub_M
CVE-2025-59937go-mail has insufficient address encoding when passing mail addresses to the SMTP client
High 8.2
In plain English
A high-severity argument injection in go-mail from wneessen. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/wneessen/go-mail | 0.7.1 | GHSA-wpwj-69cm-q9c5 |
| Go | github.com/wneessen/go-mail | 0.7.1 | GO-2025-3988 |
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5 x_refsource_CONFIRM
- https://github.com/wneessen/go-mail/issues/495 x_refsource_MISC
- https://github.com/wneessen/go-mail/pull/496 x_refsource_MISC
- https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479 x_refsource_MISC