Jakarta Mail vulnerable to SMTP Injection

ALTO 7.5CVE-2025-7962 · GHSA-9342-92gg-6v29 · Published 21/07/2025 · updated 23/06/2026

In breve

CVE-2025-7962 è una vulnerabilità ALTO (CVSS 7.5) che riguarda com.sun.mail:jakarta.mail, org.eclipse.angus:smtp, angus mail (eclipse).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.89%, superiore al 59.4% delle vulnerabilità.
Correzione: aggiornare a 2.0.2, 1.6.8, 2.0.4 o successiva.

Package	Affected versions	Patched versions
com.sun.mail:jakarta.mail Maven	`≥ 2.0.0, < 2.0.2< 1.6.8`	`2.0.21.6.8`
org.eclipse.angus:smtp Maven	`< 2.0.4`	`2.0.4`
angus mail eclipse	`< 2.0.4`	`2.0.4`
jakarta mail eclipse	`≥ 2.0.0, < 2.0.2< 1.6.8`	`2.0.21.6.8`

Description

In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

NVD description

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

References

nvd.nist.gov/vuln/detail/CVE-2025-7962 · ADVISORY
jakartaee/mail-api · WEB
jakartaee/mail-api#760 · WEB
eclipse-ee4j/angus-mail commit 269099b · WEB
eclipse-ee4j/angus-mail · PACKAGE
gitlab.eclipse.org/security/cve-assignement/-/issues/67 · WEB
gitlab.eclipse.org/security/vulnerability-reports/-/issues/290 · WEB
gitlab.eclipse.org/security/vulnerability-reports/-/issues/290 · WEB
openwall.com/lists/oss-security/2025/09/03/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free