Jakarta Mail vulnerable to SMTP Injection

HOCH 7.5CVE-2025-7962 · GHSA-9342-92gg-6v29 · Published 21/07/2025 · updated 23/06/2026

Kurz gesagt

CVE-2025-7962 ist eine Schwachstelle (HOCH (CVSS 7.5)) in com.sun.mail:jakarta.mail, org.eclipse.angus:smtp, angus mail (eclipse).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.89%, höher als bei 59.4% aller Schwachstellen.
Abhilfe: auf 2.0.2, 1.6.8, 2.0.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
com.sun.mail:jakarta.mail Maven	`≥ 2.0.0, < 2.0.2< 1.6.8`	`2.0.21.6.8`
org.eclipse.angus:smtp Maven	`< 2.0.4`	`2.0.4`
angus mail eclipse	`< 2.0.4`	`2.0.4`
jakarta mail eclipse	`≥ 2.0.0, < 2.0.2< 1.6.8`	`2.0.21.6.8`

Description

In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

NVD description

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

References

nvd.nist.gov/vuln/detail/CVE-2025-7962 · ADVISORY
jakartaee/mail-api · WEB
jakartaee/mail-api#760 · WEB
eclipse-ee4j/angus-mail commit 269099b · WEB
eclipse-ee4j/angus-mail · PACKAGE
gitlab.eclipse.org/security/cve-assignement/-/issues/67 · WEB
gitlab.eclipse.org/security/vulnerability-reports/-/issues/290 · WEB
gitlab.eclipse.org/security/vulnerability-reports/-/issues/290 · WEB
openwall.com/lists/oss-security/2025/09/03/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free