CVSS 4.0
6.0 mediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:NCVE-2025-7962
Medium (6.0) in eclipse. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in org.eclipse.angus:smtp 2.0.4.
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
- CWE
- CWE-147
- Published
- Modified
- Record from
- the NVD, synced
Affected
- eclipse:angus_mail
- eclipse:jakarta_mail
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9342-92gg-6v29 | Maven | org.eclipse.angus:smtp | <2.0.4 | 2.0.4 |
| GHSA-9342-92gg-6v29 | Maven | com.sun.mail:jakarta.mail | <1.6.8 | 1.6.8 |
| GHSA-9342-92gg-6v29 | Maven | com.sun.mail:jakarta.mail | >=2.0.0 <2.0.2 | 2.0.2 |