PT-2025-5748

CVE-2024-37358

Published

2025-02-05

Updated

2025-09-01

Description by

CVSS 3.1

8.6

High

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache James versions prior to 3.7.6 Apache James versions prior to 3.8.2

Description Apache James is susceptible to a denial of service through the misuse of IMAP literals by both authenticated and unauthenticated users. This could lead to unbounded memory allocation and prolonged computations.

Recommendations For Apache James version prior to 3.7.6, update to version 3.7.6 to restrict illegitimate use of IMAP literals. For Apache James version prior to 3.8.2, update to version 3.8.2 to mitigate the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Benoit Tellier

Xavier Guimard

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

CWE-20: Improper Input Validation