Approved changes feed: RSS · Atom
cpe:2.3:a:pebcak:go-mail:*:*:*:*:*:go:*:*part: a version: * update: *
| Vendor | Pebcak (da22ab60-6327-5c15-bb1a-d8606c97938e) |
|---|---|
| Product | Go Mail (8b4a7ded-4e7a-53c0-af8a-ab0bd3cc8bda) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | go |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-59937 |
vulnerable | 2026-06-08 07:35:23.493070 |
go-mail has insufficient address encoding when passing mail addresses to the SMTP client
go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1
Published: 2025-09-29T22:21:02.484Z
Updated: 2025-09-30T14:44:35.194Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.