{"uuid": "1c88578e-6ef2-47c7-9358-3f516826a2f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50659", "type": "seen", "source": "https://gist.github.com/alon710/af1ea10f18a378d81f14e813f0229c10", "content": "# CVE-2026-50659: CVE-2026-50659: SMTP Command and Header Injection in .NET System.Net.Mail\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-50659\n\n## Summary\nAn improper encoding and escaping vulnerability in the .NET SMTP client component allows network-based attackers to perform SMTP command smuggling and email spoofing by injecting control characters into email fields.\n\n## TL;DR\nUnescaped CR/LF characters in .NET's MailAddressParser allow SMTP protocol smuggling, enabling attackers to inject rogue SMTP commands and spoof sender details.\n\n## Technical Details\n\n- **CWE ID**: CWE-116 (Improper Encoding or Escaping of Output)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00415 (Percentile: 33.75%)\n- **Impact Type**: Integrity / Spoofing / Command Smuggling\n- **Exploit Status**: none (no public PoCs or active exploitation reported)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- .NET 10.0\n- .NET 9.0\n- .NET 8.0\n- .NET Framework 3.5\n- .NET Framework 4.6.2\n- .NET Framework 4.7\n- .NET Framework 4.7.1\n- .NET Framework 4.7.2\n- .NET Framework 4.8\n- .NET Framework 4.8.1\n- Visual Studio 2022\n- Visual Studio 2026\n- **.NET**: >= 10.0.0, < 10.0.6 (Fixed in: `10.0.6`)\n- **.NET**: >= 9.0.0, < 9.0.18 (Fixed in: `9.0.18`)\n- **.NET**: >= 8.0.0, < 8.0.29 (Fixed in: `8.0.29`)\n\n## Mitigation\n\n- Upgrade .NET and Visual Studio environments to patched releases.\n- Filter user input explicitly for carriage return (\\r) and line feed (\\n) characters prior to instantiating mail client classes.\n- Configure mail relays to reject commands with syntax errors rather than executing subsequent chained commands.\n\n**Remediation Steps:**\n1. Identify all systems relying on affected .NET runtimes (.NET 8.0, .NET 9.0, .NET 10.0, or .NET Framework).\n2. Apply the July 2026 Microsoft Security Update to all development servers and production host environments.\n3. Scan application source code for direct initialization of System.Net.Mail.MailAddress using raw user-supplied strings.\n4. Implement a centralized string validation routine to reject inputs containing control character sequences.\n\n## References\n\n- [Microsoft Security Response Center - Advisory Details](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659)\n- [CVE.org Authority Record Page](https://www.cve.org/CVERecord?id=CVE-2026-50659)\n- [NVD - CVE-2026-50659 Analysis Details](https://nvd.nist.gov/vuln/detail/CVE-2026-50659)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-50659) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T14:32:03.910847Z"}