What is GHSA-9342-92gg-6v29?

GHSA-9342-92gg-6v29 is a security advisory published by GitHub Security Advisories with Medium severity. Jakarta Mail vulnerable to SMTP Injection

Which CVE IDs does GHSA-9342-92gg-6v29 cover?

GHSA-9342-92gg-6v29 covers the following CVE IDs: CVE-2025-7962. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9342-92gg-6v29?

GHSA-9342-92gg-6v29 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-9342-92gg-6v29?

GHSA-9342-92gg-6v29 affects 3 products, including: maven/org.eclipse.angus:smtp:\u003c 2.0.4; maven/com.sun.mail:jakarta.mail:\u003c 1.6.8; maven/com.sun.mail:jakarta.mail:\u003e= 2.0.0, \u003c 2.0.2.

GHSA-9342-92gg-6v29MediumCVSS 7.5

Jakarta Mail vulnerable to SMTP Injection

Vendor

GitHub Security Advisories

Published

July 21, 2025

Last Modified

April 16, 2026

🔗 CVE IDs covered (1)

CVE-2025-7962 →

📋 Description

In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

🎯 Affected products3

maven/org.eclipse.angus:smtp:< 2.0.4
maven/com.sun.mail:jakarta.mail:< 1.6.8
maven/com.sun.mail:jakarta.mail:>= 2.0.0, < 2.0.2

🔗 References (9)

https://nvd.nist.gov/vuln/detail/CVE-2025-7962
https://gitlab.eclipse.org/security/cve-assignement/-/issues/67
https://github.com/eclipse-ee4j/angus-mail/commit/269099b652a0a5c2fa140f1296a18f0fbbea0d44
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/290
http://www.openwall.com/lists/oss-security/2025/09/03/4
https://github.com/jakartaee/mail-api/issues/765
https://github.com/jakartaee/mail-api/pull/760
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/290#note_5320539
https://github.com/advisories/GHSA-9342-92gg-6v29