CVE-2025-7962

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

Score

CVSS 3.1 7.5 High

Status

Modified - emo@eclipse.org

Published

2025-07-21

Last modified

2026-06-23

Weaknesses

CWE-147

Affected products

• Angus Mail (Eclipse)
• Jakarta Mail (Eclipse)
• Jakarta Mail (Eclipse Foundation)

References

• https://gitlab.eclipse.org/security/cve-assignement/-/issues/67
• http://www.openwall.com/lists/oss-security/2025/09/03/4