CVE-2025-7962: Jakarta Mail SMTP Injection Vulnerability in org.eclipse.angus:smtp
Summary
CVE-2025-7962: Jakarta Mail vulnerable to SMTP Injection. Affects org.eclipse.angus:smtp versions < 2.0.4. Fixed in 2.0.4. How to fix ↓
Also tracked for
- jakarta-mail · Debian:11
The same CVE-2025-7962 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jakarta Mail is a popular library used for sending and receiving email in Java applications. It provides a robust framework for handling email protocols, including SMTP, IMAP, and POP3. The org.eclipse.angus:smtp package specifically focuses on the SMTP protocol, enabling developers to send emails efficiently. However, a vulnerability has been identified that allows for SMTP injection, which can compromise the integrity of email communications.
Vulnerability Detail
In Jakarta Mail version 2.2, a vulnerability exists that allows attackers to perform SMTP injection by exploiting the use of \r and \n UTF-8 characters to separate different messages. This can lead to unauthorized commands being executed on the mail server, potentially allowing attackers to send malicious emails or manipulate email content. The vulnerability is classified under CWE-147, indicating a failure to properly validate input, which can have moderate severity implications for applications relying on this library.
How To Fix
Latest published version: 2.1.0-M1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing input validation to sanitize any user inputs that may be used in SMTP commands. This can help mitigate the risk of injection attacks until the package can be updated.
Conclusion
The Jakarta Mail vulnerability CVE-2025-7962 poses a significant risk due to the potential for SMTP injection. It is crucial for developers using the org.eclipse.angus:smtp package to update to version 2.0.4 or later to safeguard their applications against this threat.
See every vulnerability recorded for org.eclipse.angus:smtp →
FAQ
SMTP injection is a type of attack where an attacker manipulates SMTP commands to send unauthorized emails or alter email content.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences can include unauthorized email sending, manipulation of email content, and potential exploitation of the mail server.
The CVSS score of this vulnerability is 7.5, indicating a moderate severity level.
It is recommended to regularly check for updates to your dependencies and apply patches as soon as they are available to mitigate security risks.
