CVE catalog

CVE-2025-7962

jakarta-mail: CVE-2025-7962

Severity: Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: Jul 21, 2025, 5:22:12 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.89% · Oct 25, 2026

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	javamail	sid	`1.6.5-3`	vulnerable
Debian	javamail	forky	`1.6.5-3`	vulnerable
Debian	javamail	trixie	`1.6.5-3`	vulnerable
Debian	javamail	bookworm	`1.6.5-2`	vulnerable
Debian	jakarta-mail	sid	`2.0.0-2`	vulnerable
Debian	jakarta-mail	forky	`2.0.0-2`	vulnerable
Debian	jakarta-mail	trixie	`2.0.0-2`	vulnerable
Debian	jakarta-mail	bookworm	`2.0.0-2`	vulnerable
Opensuse	ant	tumbleweed	`1.10.18-1.1`	fixed
Suse	javamail	linux enterprise module for basesystem 15 sp6	`1.6.2-150200.3.7.1`	fixed
Suse	javamail	linux enterprise module for basesystem 15 sp7	`1.6.2-150200.3.7.1`	fixed
Opensuse	javamail	leap 15.6	`1.6.2-150200.3.7.1`	fixed
Opensuse	javamail	tumbleweed	`1.6.2-3.1`	fixed
Ubuntu	jakarta-mail	22.04	`2.0.0-2`	vulnerable
Ubuntu	jakarta-mail	24.04	`2.0.0-2`	vulnerable
Ubuntu	jakarta-mail	25.10	`2.0.0-2`	vulnerable
Ubuntu	jakarta-mail	26.10	`2.0.0-2build1`	vulnerable
Ubuntu	jakarta-mail	26.04	`2.0.0-2`	vulnerable
Ubuntu	jakarta-mail	26.04	`2.0.0-2build1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	javamail	source	sid	`(unfixed)`	not yet assigned	Not reported	[1109824]
Debian	javamail	source	forky	`(unfixed)`	not yet assigned	Not reported	[1109824]
Debian	javamail	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1109824]
Debian	javamail	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1109824]
Debian	jakarta-mail	source	sid	`(unfixed)`	not yet assigned	Not reported	[1109804]
Debian	jakarta-mail	source	forky	`(unfixed)`	not yet assigned	Not reported	[1109804]
Debian	jakarta-mail	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1109804]
Debian	jakarta-mail	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1109804]
Opensuse	ant	rpm	tumbleweed	`1.10.18-1.1`	Not reported	OPENSUSE-SU-2026:11763-1	Not reported
Suse	javamail	rpm	linux enterprise module for basesystem 15 sp6	`1.6.2-150200.3.7.1`	Not reported	SUSE-SU-2025:03025-1	Not reported
Suse	javamail	rpm	linux enterprise module for basesystem 15 sp7	`1.6.2-150200.3.7.1`	Not reported	SUSE-SU-2025:03025-1	Not reported
Opensuse	javamail	rpm	leap 15.6	`1.6.2-150200.3.7.1`	Not reported	SUSE-SU-2025:03025-1	Not reported
Opensuse	javamail	rpm	tumbleweed	`1.6.2-3.1`	Not reported	OPENSUSE-SU-2025:15378-1	Not reported

[Debian bug #1109824][Debian bug #1109804]

Notes

[trixie] javamail: Minor issue [bookworm] javamail: Minor issue [trixie] jakarta-mail: Minor issue [bookworm] jakarta-mail: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libjakarta-mail-java]Affected
Source package: [jakarta-mail]
Details (2)
- 2.0.0-2 · all · bookworm
  Affected
  dsa · jakarta-mail · debian · bookworm; dsa · jakarta-mail · debian · 12
- 2.0.0-2 · all · bookworm
  Affected
  dsa · jakarta-mail · debian · bookworm; dsa · jakarta-mail · debian · 12
[libmail-java]Affected
Source package: [javamail]
Details (2)
- 1.6.5-2 · all · bookworm
  Affected
  dsa · javamail · debian · bookworm; dsa · javamail · debian · 12
- 1.6.5-2 · all · bookworm
  Affected
  dsa · javamail · debian · bookworm; dsa · javamail · debian · 12
[libmail-java-doc]Affected
Source package: [javamail]
Details (2)
- 1.6.5-2 · all · bookworm
  Affected
  dsa · javamail · debian · bookworm; dsa · javamail · debian · 12
- 1.6.5-2 · all · bookworm
  Affected
  dsa · javamail · debian · bookworm; dsa · javamail · debian · 12

[Debian 13 (Trixie)]

[libjakarta-mail-java]Affected
Source package: [jakarta-mail]
Details (2)
- 2.0.0-2 · all · trixie
  Affected
  dsa · jakarta-mail · debian · 13
- 2.0.0-2 · all · trixie
  Affected
  dsa · jakarta-mail · debian · 13
[libmail-java]Affected
Source package: [javamail]
Details (2)
- 1.6.5-3 · all · trixie
  Affected
  dsa · javamail · debian · 13
- 1.6.5-3 · all · trixie
  Affected
  dsa · javamail · debian · 13

[openSUSE Tumbleweed]

[ant]Affected
Source package: [ant]
Details (1)
- 1.10.15-3.3 · noarch · tumbleweed
  Affected · Fixed: 1.10.18-1.1
  dsa · ant · opensuse · tumbleweed
[ant-jmf]Unknown
Source package: [ant]
Details (1)
- 1.10.15-3.3 · noarch · tumbleweed
  Unknown · Fixed: 1.10.18-1.1
  Version impact unknown
  dsa · ant · opensuse · tumbleweed
[ant-scripts]Unknown
Source package: [ant]
Details (1)
- 1.10.15-3.3 · noarch · tumbleweed
  Unknown · Fixed: 1.10.18-1.1
  Version impact unknown
  dsa · ant · opensuse · tumbleweed
[ant-swing]Unknown
Source package: [ant]
Details (1)
- 1.10.15-3.3 · noarch · tumbleweed
  Unknown · Fixed: 1.10.18-1.1
  Version impact unknown
  dsa · ant · opensuse · tumbleweed
[javamail-javadoc]Unknown
Source package: [javamail]
Details (1)
- 1.6.2-3.5 · noarch · tumbleweed
  Unknown · Fixed: 1.6.2-3.1
  Version impact unknown
  dsa · javamail · opensuse · tumbleweed
[javamail]Fixed
Source package: [javamail]
Details (1)
- 1.6.2-3.5 · noarch · tumbleweed
  Fixed · Fixed: 1.6.2-3.1
  dsa · javamail · opensuse · tumbleweed

Observed: Oct 24, 2026, 8:58:41 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]