Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an SMTP injection vulnerability due to Jakarta Mail (CVE-2025-7962)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an SMTP injection vulnerability in the Jakarta Mail library with the javaMail-1.5, javaMail-1.6, mail-2.0, or mail-2.1 feature enabled. Vulnerability Details Refer to the security...

Amazon Linux 2023 : jakarta-mail (ALAS2023-2025-1117)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1117 advisory. In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. CVE-2025-7962 Tenable has extracted the preceding description...

app.tozzi.mail:pec-parser (=4.0.0), app.tozzi:uudecoder (=4.0.0) +1257 more potentially affected by CVE-2025-7962 via com.sun.mail:jakarta.mail (>=2.0.0-RC1 <=2.0.1)

com.sun.mail:jakarta.mail MAVEN version =2.0.0-RC1, =0.2.0, =0.2.0, =2.0.1, =2.0.0, =0.1, =0.4, =1.0.0, =2022.3.4.0, =1.0.0-JDK21, =1.0.3.2-JDK21 - cn.sunyblog.easymail:easymail-spring-boot-starter3 =1.0.1 and more Source cves: CVE-2025-7962 Source advisory: SNYK:JAVA-COMSUNMAIL-12028709...

CVE-2025-7962

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages...

CVE-2025-7962

CVE-2025-7962 affects Jakarta Mail 2.0.2 and enables SMTP injection by CRLF-based message separation. IBM connected advisories confirm the issue in IBM WebSphere Liberty-backed deployments and IBM PowerVM Novalink/PowerVC Novalink, with remediation by upgrading affected products to specific fixed...