CVE-2025-7962: Medium severity Jakarta Mail vulnerability
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jakarta Mailto a version that resolves this vulnerability.Fixed in 2.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7962?
CVE-2025-7962 has a critical severity rating due to its potential for SMTP Injection attacks.
How do I fix CVE-2025-7962?
To mitigate CVE-2025-7962, ensure you validate and sanitize all user inputs for the presence of \r and \n characters before processing SMTP commands.
Which versions of Jakarta Mail are affected by CVE-2025-7962?
CVE-2025-7962 affects Jakarta Mail version 2.2 and potentially earlier versions.
What are the potential impacts of exploiting CVE-2025-7962?
Exploiting CVE-2025-7962 could allow an attacker to manipulate email messages sent via vulnerable Jakarta Mail systems.
Is there a patch available for CVE-2025-7962?
As of now, there is no official patch released for CVE-2025-7962, and users are advised to implement workarounds until a fix is provided.