SMTP Injection

🗓️ 13 Oct 2025 14:35:31Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 2 Views

Jakarta Mail is vulnerable to Simple Mail Transfer Protocol injection due to CRLF UTF-8 header validation, enabling header forging.

Reporter	Title	Published	Views	Family All 128
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by SMTP injection due to Jakarta Mail	7 Nov 202511:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by SMTP injection due to Jakarta Mail in IBM WebSphere Application Server Liberty (CVE-2025-7962)	7 Jan 202604:07	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in WebSphere Application Server Liberty affects IBM Enterprise Application Service for Java (CVE-2025-7962)	17 Dec 202514:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an SMTP injection vulnerability due to Jakarta Mail (CVE-2025-7962)	17 Nov 202515:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Test Management is affected by IBM WebSphere Application Server and Liberty are affected by SMTP injection(CVE-2025-7962)	25 Mar 202612:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with WebSphere Remote Server, are affected by SMTP injection due to Jakarta Mail	27 Nov 202501:32	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Application Server and Websphere Application Server Liberty shipped with IBM Guardium Key Lifecycle Manager (GKLM)	14 Nov 202506:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an SMTP injection vulnerability due to Jakarta Mail (CVE-2025-7962)	17 Nov 202515:14	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of IBM WebSphere Application Server, IBM Tivoli Network Manager (ITNM) IP Edition is affected by an SMTP injection vulnerability caused by Jakarta Mail(CVE-2025-7962)	18 Dec 202502:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by SMTP injection due to Jakarta Mail (CVE-2025-7962)	2 Dec 202519:10	–	ibm

Vulners

Node

eclipse angus-mailRange1.0.0-M1–2.0.3java

sun jakarta.mailRange2.0.0-RC1–2.0.1java

sun jakarta.mailRange1.6.3–1.6.7java

sun jakarta.mailRange2.0.0–2.0.1java

eclipse smtpRange1.0.0-M1–2.0.3java

eclipse smtpMatch1.0.0java

eclipse smtpMatch1.0.0-m1java

eclipse smtpMatch1.0.0-m2java

eclipse smtpMatch1.1.0java

eclipse smtpMatch2.0.0java

eclipse smtpMatch2.0.1java

eclipse smtpMatch2.0.2java

Source	Link
openwall	www.openwall.com/lists/oss-security/2025/09/03/4
github	www.github.com/eclipse-ee4j/angus-mail/commit/269099b652a0a5c2fa140f1296a18f0fbbea0d44
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-7962
gitlab	www.gitlab.eclipse.org/security/vulnerability-reports/-/issues/290
gitlab	www.gitlab.eclipse.org/security/cve-assignement/-/issues/67
github	www.github.com/eclipse-ee4j/angus-mail

03 Jun 2026 09:49Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

CVSS 46

EPSS0.00054

SSVC