---
id: CVE-2025-7962
title: "In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the\_\\r and \\n UTF-8 characters to separate different messages."
summary: "In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the\_\\r and \\n UTF-8 characters to separate different messages."
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-147
vendor: eclipse
product: jakarta_mail
affected:
  - jakarta_mail < 1.6.8
  - 'jakarta_mail >= 2.0.0, < 2.0.2'
  - angus_mail < 2.0.4
patched:
  - jakarta_mail 2.0.2
  - angus_mail 2.0.4
published: '2025-07-21'
updated: '2026-06-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-7962'
references:
  - url: 'https://gitlab.eclipse.org/security/cve-assignement/-/issues/67'
    label: emo@eclipse.org
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/03/4'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00774
epssPercentile: 0.5429
ingestedAt: '2026-06-29T13:24:34.395Z'
---

## Overview

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

## Affected

- `jakarta_mail < 1.6.8`
- `jakarta_mail >= 2.0.0, < 2.0.2`
- `angus_mail < 2.0.4`

## Remediation

Upgrade past the affected range:

- `jakarta_mail 2.0.2`
- `angus_mail 2.0.4`