TI-2024-24869 Aliases CVE-2024-37358 GHSA-56jp-w6vw-j3jw

Apache James: denial of service through the use of IMAP literals

MEDIUM 45CWE-770Published 2025-02-06 · Updated 2025-09-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00888 59th percentileScored 2026-11-07

Fix Fixed org.apache.james.protocols:protocols-imap (Maven): 3.7.6, 3.8.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache James server	up to 3.7.5; 3.8.0 – 3.8.1	—	No fix listed	CNA
—	org.apache.james.protocols:protocols-imap (Maven)	before 3.7.6	3.7.6	Patch available	GHSA-56jp-w6vw-j3jw
—	org.apache.james.protocols:protocols-imap (Maven)	3.8.0 to before 3.8.2	3.8.2	Patch available	GHSA-56jp-w6vw-j3jw

Apache James server VendorApache Affected up to 3.7.5; 3.8.0 – 3.8.1 Fixed in — No fix listed CNA
org.apache.james.protocols:protocols-imap (Maven) Vendor— Affected before 3.7.6 Fixed in 3.7.6 Patch available GHSA-56jp-w6vw-j3jw
org.apache.james.protocols:protocols-imap (Maven) Vendor— Affected 3.8.0 to before 3.8.2 Fixed in 3.8.2 Patch available GHSA-56jp-w6vw-j3jw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:james_server::::::::	before 3.7.6; 3.8.0 to before 3.8.2	Vulnerable	Apache

cpe:2.3:a:apache:james_server:*:*:*:*:*:*:*:* Versions before 3.7.6; 3.8.0 to before 3.8.2 Vulnerable ·Apache

Remediation

Fix · GHSA-56jp-w6vw-j3jw org.apache.james.protocols:protocols-imap (Maven) Fixed in 3.7.6 Advisory →
Fix · GHSA-56jp-w6vw-j3jw org.apache.james.protocols:protocols-imap (Maven) Fixed in 3.8.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-37358
2026-10-03 Alias added: GHSA-56jp-w6vw-j3jw

References

Advisory 2

Other 3

TI-2015-06317 Apache James Server 2.3.2, when configured with file-based user repositories, allows… CVSS 3.0HIGH 8.1
TI-2017-09353 Deserialization of untrusted data in Apache James CVSS 3.0HIGH 7.8
TI-2024-30645 Apache James: denial of service through JMAP HTML to text conversion CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences