Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
HIGH severity

Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Apache Sling Commons Messaging MailGHSA-c69w-jj56-834w

HIGH

GHSA-c69w-jj56-834w is a high-severity (CVSS 7.4) CWE-295 vulnerability in org.apache.sling:org.apache.sling.commons.messaging.mail. A fix is available for org.apache.sling:org.apache.sling.commons.messaging.mail — see the affected versions and patch details below.

Also known asCVE-2021-44549
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
2.1%probability of exploitation in next 30 days
Lower Risk+0.14%
Lower risk than most CVEs81th percentile — riskier than 81% of all scored CVEsHighest risk
0.00%0.88%1.77%2.65%0.2%1.9%1.9%1.9%2.1%Jun 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-c69w-jj56-834w by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
☕org.apache.sling:org.apache.sling.commons.messaging.mail

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.sling:org.apache.sling.commons.messaging.mailall versions2.0org.apache.sling:org.apache.sling.commons.messaging.mail:2.0

Affected Products

1 product · 1 configurations
Application
sling commons messaging mailapache
1 version
1.0.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.sling:org.apache.sling.commons.messaging.mail, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.apache.sling:org.apache.sling.commons.messaging.mail to 2.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-c69w-jj56-834w is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This vulnerability should be considered of important severity rather than moderate because it directly impacts the integrity and confidentiality of email communications over SMTPS. By disabling server identity checks, it leaves the communication channel vulnerable to "man-in-the-middle" (MITM) attacks, where an…

Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Source: Red Hat security advisory for GHSA-c69w-jj56-834w (CC BY 4.0)
ProductFixed inAdvisory
OCP-Tools-4.12-RHEL-8jenkins-0:2.462.3.1730119132-3.el8RHSA-2024:8886
OCP-Tools-4.13-RHEL-8jenkins-0:2.462.3.1729839924-3.el8RHSA-2024:8887
OCP-Tools-4.14-RHEL-8jenkins-0:2.462.3.1729839727-3.el8RHSA-2024:8885
OCP-Tools-4.15-RHEL-8jenkins-0:2.462.3.1729837947-3.el8RHSA-2024:8884
Red Hat build of Quarkus 3.2angus-mailRHSA-2024:7676
Red Hat build of Quarkus 3.8see advisoryRHSA-2024:7670

Frequently Asked Questions

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessag
O3 Security · Impact-Aware SCA

Is GHSA-c69w-jj56-834w in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
Improper Certificate Validation and Improper Validation of…