CVE-2023-51747

Apache James SMTP server is affected in versions prior to 3.8.1 and 3.7.5. The root cause is lenient line-delimiter handling, which can enable SMTP smuggling by causing differences in interpretation between sender and receiver, potentially bypassing SPF checks. The fix enforces CRLF as the line d...

CVE-2022-28220

CVE-2022-28220 affects Apache James prior to release 3.6.3 and 3.7.1. The issue is a vulnerability in STARTTLS handling that enables a buffering attack. The root cause is related to a parser differential from CVE-2021-38542 and does not account for concurrent requests. The CVSS base score is 7.5 ...

CVE-2021-40110

CVE-2021-40110 affects Apache James prior to 3.6.1. A DoS can be triggered by an IMAP user crafting LIST commands that exploit a vulnerable regular expression; upgrading to Apache James 3.6.1 or higher enforces the RE2J regex engine to execute in linear time and mitigates the issue. The available...

CVE-2023-26269

Summary: CVE-2023-26269 affects Apache James Server 3.7.3 and earlier, where a default unauthenticated JMX management interface enables local privilege escalation when a local user connects to JMX. The root cause is an unprotected JMX service by default; exploitation leads to compromise of the Ja...

CVE-2006-2806

CVE-2006-2806: The SMTP server in Apache Java Mail Enterprise Server (Apache James) 2.2.0 is vulnerable to a denial-of-service via a long argument to the MAIL command, consuming CPU. No exploitation or remediation details are provided in the connected documents.