CVE-2025-7962

Published: Jul 21, 2025Modified: Jun 23, 2026

6.0

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: emo@eclipse.org (Secondary)

Description

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

Affected (3)

Products: Eclipse: Jakarta Mail, Angus Mail

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Eclipse Jakarta Mail	Before 1.6.8
Eclipse Jakarta Mail	From 2.0.0 to 2.0.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Eclipse Angus Mail	Before 2.0.4

Related CWEs

Improper Neutralization of Input Terminators

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.

References (2)

https://gitlab.eclipse.org/security/cve-assignement/-/issues/67

Source: emo@eclipse.org

Issue TrackingThird Party Advisory

http://www.openwall.com/lists/oss-security/2025/09/03/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.