In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by…
Priority LOW 29CWE-147Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 8 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00891 59th percentileScored 2026-11-07
Fix Partial Jakarta Mail (Eclipse Foundation): 1.6.8, 2.0.2org.eclipse.angus:smtp (Maven): 2.0.4+1 more productRed Hat: 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Jakarta Mail | — | 1.6.8, 2.0.2 | Patch available | CNA |
| — | org.eclipse.angus:smtp (Maven) | before 2.0.4 | 2.0.4 | Patch available | GHSA-9342-92gg-6v29 |
| — | com.sun.mail:jakarta.mail (Maven) | before 1.6.8 | 1.6.8 | Patch available | GHSA-9342-92gg-6v29 |
| — | com.sun.mail:jakarta.mail (Maven) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-9342-92gg-6v29 |
- Jakarta Mail VendorEclipse Foundation Affected — Fixed in 1.6.8, 2.0.2 Patch available CNA
- org.eclipse.angus:smtp (Maven) Vendor— Affected before 2.0.4 Fixed in 2.0.4 Patch available GHSA-9342-92gg-6v29
- com.sun.mail:jakarta.mail (Maven) Vendor— Affected before 1.6.8 Fixed in 1.6.8 Patch available GHSA-9342-92gg-6v29
- com.sun.mail:jakarta.mail (Maven) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-9342-92gg-6v29
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jakarta_mail:*:*:*:*:*:*:*:* | before 1.6.8; 2.0.0 to before 2.0.2 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:angus_mail:*:*:*:*:*:*:*:* | before 2.0.4 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:jakarta_mail:*:*:*:*:*:*:*:* Versions before 1.6.8; 2.0.0 to before 2.0.2 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:angus_mail:*:*:*:*:*:*:*:* Versions before 2.0.4 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Jakarta Mail (Eclipse Foundation) Fixed in 1.6.8, 2.0.2
- Fix · GHSA-9342-92gg-6v29 org.eclipse.angus:smtp (Maven) Fixed in 2.0.4 Advisory →
- Fix · GHSA-9342-92gg-6v29 com.sun.mail:jakarta.mail (Maven) Fixed in 1.6.8 Advisory →
- Fix · GHSA-9342-92gg-6v29 com.sun.mail:jakarta.mail (Maven) Fixed in 2.0.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
Not affected: 10 products
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Dev Spaces
- Red Hat Process Automation 7
- Red Hat Satellite 6
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7962
- 2026-10-03 Alias added: GHSA-9342-92gg-6v29
References
Advisory 3
Other 6
- https://github.com/jakartaee/mail-api/issues/765
- https://github.com/jakartaee/mail-api/pull/760
- https://github.com/eclipse-ee4j/angus-mail/commit/269099b652a0a5c2fa140f1296a18f0fbbea0d44
- https://github.com/eclipse-ee4j/angus-mail
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/290
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/290#note_5320539
Sources
- CVE-2025-7962 · CVE Program
- CVE-2025-7962 · NVD
- FIRST EPSS
- GHSA-9342-92gg-6v29 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-7962 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences