Detections
Analytics
SCA: security update for github.com/wneessen/go-mail (GHSA-wpwj-69cm-q9c5)
high Tenable Self-Hosted Container Security Plugin ID 435452
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to
incorrect handling of the mail.Address values when a sender- or recipient address is passed to the
corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address
routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's
code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail
addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local
parts, this should not affect users. This issue is fixed in version 0.7.1 (CVE-2025-59937)
See Also
Plugin Details
Severity: High
ID: 435452
Version: Revision 1.10
Type: Local
Family: SCA Checks
Published: 9/29/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.4
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 9.4
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N
CVSS Score Source: CVE-2025-59937
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 8.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.2
Threat Score: 6.9
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/29/2025
Vulnerability Publication Date: 9/29/2025
Reference Information
CVE: CVE-2025-59937
cwe: CWE-88