CVE-2022-28220: Apache James vulnerable to buffering attack
Summary
CVE-2022-28220: Apache James vulnerable to buffering attack. Affects org.apache.james:james-server across 2 version ranges.
< 3.6.3
>= 3.7.0, < 3.7.1
Fixed in 3.6.3 or 3.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache James is an open-source email server that provides a platform for sending, receiving, and storing email messages. It is commonly used in enterprise environments and offers various features for managing email communication. However, versions prior to release 3.6.3 and 3.7.1 of Apache James are susceptible to a buffering attack when using the STARTTLS command. This vulnerability, identified as CVE-2022-28220, is related to a similar issue addressed in Apache James 3.6.1 but has not been fully resolved, leading to potential exploitation through concurrent requests.
Vulnerability Detail
The vulnerability in Apache James allows for a buffering attack that can be initiated by exploiting the STARTTLS command. This attack can have severe consequences, potentially leading to unauthorized access, data leakage, or other malicious activities. The fix implemented for a similar issue in Apache James 3.6.1 is not sufficient to mitigate this vulnerability due to a parser differential and the lack of consideration for concurrent requests. As a result, versions 3.6.3 and 3.7.1 of Apache James remain vulnerable to this attack.
How To Fix
Latest published version: 3.9.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.6.33.6.3 -
>= 3.7.0, < 3.7.13.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is crucial to apply the recommended fix by updating Apache James to the patched versions.
Conclusion
Apache James versions prior to 3.6.3 and 3.7.1 are vulnerable to a buffering attack when using the STARTTLS command. This vulnerability can have severe consequences, including unauthorized access and data leakage. It is crucial to update Apache James to the patched versions (3.6.3 or 3.7.1) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.james:james-server →
FAQ
Apache James is an open-source email server used for sending, receiving, and storing email messages in enterprise environments.
A buffering attack is a type of security vulnerability where an attacker can exploit a buffer overflow or other memory-related issue to gain unauthorized access or execute malicious code.
The STARTTLS command is used in email communication to initiate a secure TLS connection between the email client and server, ensuring the confidentiality and integrity of the transmitted data.
This vulnerability can lead to unauthorized access, data leakage, or other malicious activities, depending on the attacker's intentions and capabilities.
To update Apache James, follow the upgrade instructions provided by the Apache James project. These instructions will guide you through the process of updating to version 3.6.3 or 3.7.1, depending on your current installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.james:james-server.
