{"cve":"CVE-2023-51747","nvd":{"published":"2024-02-27T14:15:27.030","modified":"2026-06-17T06:41:35.373","status":"Analyzed","description":"Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.\n\nA lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.\n\nThe patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.\n\nWe recommend James users to upgrade to non vulnerable versions.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","score":7.1},"cwes":["CWE-20","CWE-290","CWE-444"],"references":["http://www.openwall.com/lists/oss-security/2024/02/27/4","https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko","https://postfix.org/smtp-smuggling.html","https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/","http://www.openwall.com/lists/oss-security/2024/02/27/4"],"products":["apache:james"],"source":"nvd","synced_at":"2026-10-19T21:45:59.823092188+00:00"},"epss":{"cve":"CVE-2023-51747","score":0.01045,"percentile":0.64171,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-p5q9-86w4-2xr5","url":"https://osv.dev/vulnerability/GHSA-p5q9-86w4-2xr5","summary":"SMTP smuggling in Apache James","modified":"2024-11-13T23:32:43.264836Z","packages":[{"ecosystem":"Maven","name":"org.apache.james:james-server","purl":"pkg:maven/org.apache.james/james-server","ranges":["<3.7.5"],"fixed":["3.7.5"]},{"ecosystem":"Maven","name":"org.apache.james:james-server","purl":"pkg:maven/org.apache.james/james-server","ranges":[">=3.8.0 <3.8.1"],"fixed":["3.8.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}