CVE-2025-7962

HIGH
Published Jul 21, 2025 Modified Nov 13, 2025 CWE-147

Description

In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

Is your site exposed to CVE-2025-7962?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness Type (CWE)

CWE-147 CWE-147

Affected Products

Vendor Product
eclipse jakarta_mail
eclipse jakarta_mail
eclipse angus_mail

References

Frequently Asked Questions

What is CVE-2025-7962? +
In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. It has a CVSS v3.1 base score of 7.5 (HIGH).
How severe is CVE-2025-7962? +
CVE-2025-7962 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
What products are affected by CVE-2025-7962? +
CVE-2025-7962 affects products from eclipse, specifically: angus_mail, jakarta_mail. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2025-7962? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-52006 7.5

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations …
CVE-2024-52505 5.4

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to …
CVE-2024-50349 4.7

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations …
CVE-2025-67109 10.0

Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute …
CVE-2024-9342 9.8

In Eclipse GlassFish version 7.0.16 or earlier it is possible to perform Login Brute Force attacks as there is no …
CVE-2024-9408 9.8

In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2025-7962 — free, no signup required.