Apache James vulnerable to denial of service through JMAP HTML to text conversion
Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-45626US | high7.5 | — | ||
Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.
Use… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/02/05/7WEB
- https://github.com/apache/james-project/commit/372f1f83b6825fb0f92147803a9bf215b8ff690dWEB
- https://github.com/apache/james-project/commit/537ae380f9837f74c075f0ed2b625affa9b20122WEB
- https://github.com/apache/james-project/pull/1422WEB
- https://github.com/linagora/james-projectPACKAGE
- https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn4klWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-45626ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan