CVE-2017-9801: Improper Input Validation in Apache Commons Email
Summary
CVE-2017-9801: Improper Input Validation in Apache Commons Email. Affects org.apache.commons:commons-email versions >= 1.0, < 1.5. Fixed in 1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Email is a library that provides a simple API for sending email messages. It is commonly used in Java applications to handle email functionality. This vulnerability affects versions 1.0 through 1.4 of the Apache Commons Email library. The library allows users to specify the subject of an email, but when line-breaks are included in the subject, it fails to properly validate the input. This can lead to the addition of arbitrary SMTP headers by an attacker.
Vulnerability Detail
The vulnerability arises from the improper input validation in the Apache Commons Email library. When a subject with line-breaks is passed to the library, it does not correctly validate the input. As a result, an attacker can exploit this vulnerability to add arbitrary SMTP headers to an email. This could potentially lead to various security issues, such as spoofing, phishing, or injection attacks.
How To Fix
Latest published version: 1.6.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround is to sanitize the subject input before passing it to the Apache Commons Email library. This can be done by removing any line-break characters from the subject string. Here is an example in Java:
String sanitizedSubject = subject.replace("\n", "").replace("\r", "");
Conclusion
The vulnerability in Apache Commons Email 1.0 through 1.4 allows for improper input validation, enabling the addition of arbitrary SMTP headers. To mitigate this vulnerability, it is crucial to upgrade to version 1.5 or later of the Apache Commons Email library. If immediate upgrading is not possible, a temporary workaround is available by sanitizing the subject input. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.commons:commons-email →
FAQ
Apache Commons Email is a Java library that provides an API for sending email messages. It is widely used in Java applications for email functionality.
Versions 1.0 through 1.4 of the Apache Commons Email library are affected by this vulnerability.
This vulnerability allows an attacker to add arbitrary SMTP headers to an email, potentially leading to security issues such as spoofing, phishing, or injection attacks.
To fix this vulnerability, it is recommended to upgrade to version 1.5 or later of the Apache Commons Email library.
A temporary workaround is to sanitize the subject input by removing any line-break characters before passing it to the Apache Commons Email library.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.commons:commons-email.
