CVE-2023-51747
highpriority · track · 0EPSS 0.010 · 64 %ileEUUSEPSS · scored 2026-10-27
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks. The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction. We recommend James users to upgrade to non vulnerable versions.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-p5q9-86w4-2xr5SMTP smuggling in Apache James2024-02-27ghsa · osvUS
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks. The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction. We recommend James users to upgrade to non vulnerable versions.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (14)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2024/02/27/4cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-51747/cnnvd
- https://james.apache.org/download.cgiPatchcnnvd
- https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydkocnnvd
- https://postfix.org/smtp-smuggling.htmlcnnvd
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/cnnvd
- http://www.openwall.com/lists/oss-security/2024/02/27/4enisa_euvd
- https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydkoenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan