DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-50659: CVE-2026-50659: SMTP Command and Header Injection in .NET System.Net.Mail

#security #cve #cybersecurity

CVE-2026-50659: SMTP Command and Header Injection in .NET System.Net.Mail

Vulnerability ID: CVE-2026-50659
CVSS Score: 6.5
Published: 2026-07-20

An improper encoding and escaping vulnerability in the .NET SMTP client component allows network-based attackers to perform SMTP command smuggling and email spoofing by injecting control characters into email fields.

TL;DR

Unescaped CR/LF characters in .NET's MailAddressParser allow SMTP protocol smuggling, enabling attackers to inject rogue SMTP commands and spoof sender details.

Technical Details

  • CWE ID: CWE-116 (Improper Encoding or Escaping of Output)
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 6.5 (Medium)
  • EPSS Score: 0.00415 (Percentile: 33.75%)
  • Impact Type: Integrity / Spoofing / Command Smuggling
  • Exploit Status: none (no public PoCs or active exploitation reported)
  • CISA KEV Status: Not Listed

Affected Systems

  • .NET 10.0
  • .NET 9.0
  • .NET 8.0
  • .NET Framework 3.5
  • .NET Framework 4.6.2
  • .NET Framework 4.7
  • .NET Framework 4.7.1
  • .NET Framework 4.7.2
  • .NET Framework 4.8
  • .NET Framework 4.8.1
  • Visual Studio 2022
  • Visual Studio 2026
  • .NET: >= 10.0.0, < 10.0.6 (Fixed in: 10.0.6)
  • .NET: >= 9.0.0, < 9.0.18 (Fixed in: 9.0.18)
  • .NET: >= 8.0.0, < 8.0.29 (Fixed in: 8.0.29)

Code Analysis

Commit: 9db47f0

Enforce validation rules on mail addresses to detect and reject Carriage Return (CR) and Line Feed (LF) characters inside MailAddressParser.

Mitigation Strategies

  • Upgrade .NET and Visual Studio environments to patched releases.
  • Filter user input explicitly for carriage return (\r) and line feed (\n) characters prior to instantiating mail client classes.
  • Configure mail relays to reject commands with syntax errors rather than executing subsequent chained commands.

Remediation Steps:

  1. Identify all systems relying on affected .NET runtimes (.NET 8.0, .NET 9.0, .NET 10.0, or .NET Framework).
  2. Apply the July 2026 Microsoft Security Update to all development servers and production host environments.
  3. Scan application source code for direct initialization of System.Net.Mail.MailAddress using raw user-supplied strings.
  4. Implement a centralized string validation routine to reject inputs containing control character sequences.

References

Read the full report for CVE-2026-50659 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)