CVE-2025-7962

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-21 · updated 2026-06-23
Weakness: CWE-147

Description

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

Affected products

eclipse Angus Mail: before 2.0.4 — fixed in 2.0.4
eclipse Jakarta Mail: before 1.6.8; from 2.0.0 before 2.0.2 — fixed in 1.6.8, 2.0.2

How to fix

Upgrade to a fixed version: eclipse Angus Mail 2.0.4; eclipse Jakarta Mail 1.6.8, 2.0.2. Check the vendor advisory for mitigations.

References

https://gitlab.eclipse.org/security/cve-assignement/-/issues/67
http://www.openwall.com/lists/oss-security/2025/09/03/4

Get alerted when CVE-2025-7962 or the next vulnerability affects your stack