SMTP smuggling in Apache James

CAO 7.1CVE-2023-51747 · GHSA-p5q9-86w4-2xr5 · Công bố 27/02/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-51747 là lỗ hổng mức CAO (CVSS 7.1) ảnh hưởng org.apache.james:james-server, james (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 64.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.8.1, 3.7.5 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.james:james-server Maven	`≥ 3.8.0, < 3.8.1< 3.7.5`	`3.8.13.7.5`
james apache	`= 3.7.5= 3.8.1`	Chưa có bản vá

Mô tả

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.

A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.

The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.

We recommend James users to upgrade to non vulnerable versions.

Mô tả của NVD

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks. The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction. We recommend James users to upgrade to non vulnerable versions.