Executive brief
Jakarta Mail is a widely used Java framework for sending and receiving emails. A vulnerability in how the library handles special characters allows an attacker to inject malicious commands into the email delivery process. This could enable an attacker to send unauthorized emails, modify message content, or redirect messages to unintended recipients, potentially leading to phishing or data exfiltration.
Technical details
Jakarta Mail (and its implementation Angus Mail) is vulnerable to SMTP Injection due to improper neutralization of input terminators (CWE-147). Specifically, the library fails to properly sanitize UTF-8 encoded carriage return (\r) and newline (\n) characters when processing email metadata. An attacker who can control input fields that are later used in SMTP commands—such as recipient addresses—can inject additional SMTP commands into the session. This allows for the transmission of arbitrary email messages or the modification of existing message headers. The vulnerability is fixed in Jakarta Mail 1.6.8 and 2.0.2, and Angus Mail 2.0.4.
Affected products
- Eclipse Foundation Jakarta Mail < 1.6.8, 2.0.0 to < 2.0.2
- Eclipse Foundation Angus Mail < 2.0.4
- Jenkins Jakarta Mail API Plugin <= 2.1.3-2
Timeline
- 2025-07-21: advisory: Initial advisory published by Eclipse Foundation
- 2025-09-03: patched: Jenkins Jakarta Mail API Plugin updated to 2.1.3-3 to address the issue