SMTP smuggling in Apache James
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks. The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction. We recommend James users to upgrade to non vulnerable versions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache James server | up to 3.7.4; 3.8 – 3.8.0 | — | No fix listed | CNA |
| — | org.apache.james:james-server (Maven) | before 3.7.5 | 3.7.5 | Patch available | GHSA-p5q9-86w4-2xr5 |
| — | org.apache.james:james-server (Maven) | 3.8.0 to before 3.8.1 | 3.8.1 | Patch available | GHSA-p5q9-86w4-2xr5 |
- Apache James server VendorApache Affected up to 3.7.4; 3.8 – 3.8.0 Fixed in — No fix listed CNA
- org.apache.james:james-server (Maven) Vendor— Affected before 3.7.5 Fixed in 3.7.5 Patch available GHSA-p5q9-86w4-2xr5
- org.apache.james:james-server (Maven) Vendor— Affected 3.8.0 to before 3.8.1 Fixed in 3.8.1 Patch available GHSA-p5q9-86w4-2xr5
Remediation
- Fix · GHSA-p5q9-86w4-2xr5 org.apache.james:james-server (Maven) Fixed in 3.7.5 Advisory →
- Fix · GHSA-p5q9-86w4-2xr5 org.apache.james:james-server (Maven) Fixed in 3.8.1 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-51747
- 2026-10-03 Alias added: GHSA-p5q9-86w4-2xr5
References
Advisory 3
Other 6
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
- https://postfix.org/smtp-smuggling.html
- https://github.com/apache/james-project/commit/d1ef102540e504c067b6c1721a6f1e7eee9c6fc6
- https://github.com/apache/james-project/commit/d5cd8bb098aa78d8d62c9645f3c532689ef1cb03
- https://github.com/apache/james-project
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide
More Apache James vulnerabilities
- TI-2019-00201 XML external entity injection in Apache PDFBox CVSS 3.1CRITICAL 9.8
- TI-2023-28170 Apache James server: Privilege escalation via JMX pre-authentication deserialisation CVSS 3.1CRITICAL 9.8
- TI-2021-17565 Sieve file storage vulnerable to path traversal attacks CVSS 3.1CRITICAL 9.1
- TI-2006-02714 The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows… CVSS 2.0HIGH 7.8
- TI-2021-17305 Apache James IMAP vulnerable to a ReDoS CVSS 3.1HIGH 7.5
- TI-2023-11431 Apache James server: Privilege escalation through unauthenticated JMX CVSS 3.1HIGH 7.8
Sources
- CVE-2023-51747 · CVE Program
- CVE-2023-51747 · NVD
- FIRST EPSS
- GHSA-p5q9-86w4-2xr5 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-51747 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences