{"id":"CVE-2025-7962","aliases":["GHSA-9342-92gg-6v29"],"url":"https://o3.security/vulnerability/CVE-2025-7962","summary":"Jakarta Mail vulnerable to SMTP Injection","details":"In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \\r and \\n UTF-8 characters to separate different messages.","published":"2025-07-21T17:22:12.520Z","modified":"2026-07-15T01:48:50.799033705Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.eclipse.angus:smtp","fixedVersion":"2.0.4"},{"ecosystem":"Maven","name":"com.sun.mail:jakarta.mail","fixedVersion":"1.6.8"},{"ecosystem":"Maven","name":"com.sun.mail:jakarta.mail","fixedVersion":"2.0.2"}],"fix":null,"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/09/03/4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7962.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7962"},{"type":"REPORT","url":"https://gitlab.eclipse.org/security/cve-assignement/-/issues/67"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:50.799033705Z"}}