VulnerabilityModified
CVE-2025-7962
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
MEDIUM 6.0EPSS 0.77%
Does this matter?
Lower severity and a low EPSS score (0.77%). Track it; it rarely justifies an emergency change on its own.
Description
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
- CVSS 4.0
- 6.0 MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.77% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-147
- Affected
- eclipse/jakarta mail · eclipse/angus mail
- Source
- emo@eclipse.org
References
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/67Issue Tracking, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2025/09/03/4Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.