Jakarta Mail CVE-2025-7962

Exploitation requires two concurrent conditions: the target application must use Jakarta Mail (or Angus Mail) in a version prior to 2.0.2, AND at least one user-controlled string (such as a display name, subject line, reply-to address, or custom header value) must be passed without prior sanitization to a Jakarta Mail API that constructs outbound SMTP traffic. The CVSS PR:L rating indicates that a low-privilege authenticated position within the application is sufficient - unauthenticated exploitation is not confirmed from available data. The AC:H rating reflects that the attacker must identify an input path that routes through the Jakarta Mail SMTP construction layer without intermediate sanitization. Exploitation is limited to integrity impacts (SMTP command injection, message forging, header manipulation); there is no confirmed path to confidentiality disclosure or denial of service. Applications that sanitize email fields at the application layer before invoking Jakarta Mail are not exploitable regardless of library version.

The CVSS 4.0 score of 6.0 (Medium) reflects the real-world constraints: network access is required (AV:N), but complexity is rated High (AC:H), meaning exploitation is not trivial and depends on specific input routing through the library. Privileges are rated Low (PR:L), indicating that an attacker typically needs some authenticated foothold in the application that invokes Jakarta Mail. The integrity impact is High on the vulnerable system (VI:H) - meaning message content and SMTP command flow can be substantially corrupted - while the subsequent system impact is rated Low (SI:L), capturing limited downstream effects on mail server state. There is no confidentiality or availability impact, narrowing the blast radius to integrity-focused attacks such as email spoofing, header injection, or unauthorized message relay. EPSS data is not available in the provided intelligence, and the CVE is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. Overall, this is a legitimate integrity risk in Java applications that pass untrusted user input to Jakarta Mail without pre-sanitizing email fields - it is not a panic-priority critical but warrants prompt patching given the deterministic nature of the injection class.

An attacker with a low-privilege account in a web application (e.g., a user who can submit a support ticket or update their display name) provides a crafted string containing \r\n UTF-8 sequences in a field that the application passes directly to Jakarta Mail as an email header or body parameter. Jakarta Mail forwards the unsanitized content to the SMTP server as part of the message transaction. The injected newlines terminate the current SMTP command and introduce a new command - for example, injecting a second RCPT TO directive to send a copy of a message to an unintended recipient, or injecting a DATA segment to relay a forged message through the trusted mail server. No public proof-of-concept code has been identified at time of analysis.