TI-2004-02520 Aliases CVE-2004-2650 GHSA-92j7-34x9-f3jw

Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service…

LOW 23CWE-400Published 2005-12-09 · Updated 2024-09-17

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Complete
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.

Why it matters now

EPSS 0.00561 46th percentileScored 2026-11-07

Fix Fixed org.apache.james:james-server (Maven): 2.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.apache.james:james-server (Maven)	before 2.2.0	2.2.0	Patch available	GHSA-92j7-34x9-f3jw

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.apache.james:james-server (Maven) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-92j7-34x9-f3jw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:james:2.2.0:::::::*	2.2.0	Vulnerable	Apache

cpe:2.3:a:apache:james:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache

Remediation

Fix · GHSA-92j7-34x9-f3jw org.apache.james:james-server (Maven) Fixed in 2.2.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2004-2650
2026-10-03 Alias added: GHSA-92j7-34x9-f3jw

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2004-2650

Other 2

TI-2019-00201 XML external entity injection in Apache PDFBox CVSS 3.1CRITICAL 9.8
TI-2023-28170 Apache James server: Privilege escalation via JMX pre-authentication deserialisation CVSS 3.1CRITICAL 9.8
TI-2021-17565 Sieve file storage vulnerable to path traversal attacks CVSS 3.1CRITICAL 9.1
TI-2006-02714 The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows… CVSS 2.0HIGH 7.8
TI-2021-17305 Apache James IMAP vulnerable to a ReDoS CVSS 3.1HIGH 7.5
TI-2023-11431 Apache James server: Privilege escalation through unauthenticated JMX CVSS 3.1HIGH 7.8

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences