VULNERABILITY INTELLIGENCE

CVE-2024-37358

CVSS score8.6 HIGH
EPSS probability0.89%
CISA KEVNot currently listed
Published2025-02-06
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Description

Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.

Weakness classification

  • security@apache.org: CWE-770
  • nvd@nist.gov: CWE-770

Primary references