Description
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | Jakarta Mail | — | 1.6.8 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | javamail +1 | No fix yet | — |
| Debian 13 | javamail +1 | No fix yet | — |
| Debian 12 | javamail +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jakarta-mail | No fix yet | — |
| Ubuntu 26.04 LTS | jakarta-mail | No fix yet | — |
| Ubuntu 25.10 | jakarta-mail | No fix yet | — |
| Ubuntu 24.04 LTS | jakarta-mail | No fix yet | — |
| Ubuntu 22.04 LTS | jakarta-mail | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | ant +3 | 1.10.18-150200.4.31.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | ant-contrib | 1.0b3-150200.11.17.1 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | antlr | 2.7.7-150200.18.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | assertj-core | 3.27.7-150200.5.11.8 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | bsf | 2.4.0-150200.13.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | byte-buddy | 1.18.8-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | jakarta-activation | 2.1.0-150200.5.7.1 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | jakarta-mail | 2.1.0-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | javamail | 1.6.2-150200.3.7.1 | SUSE-SU-2025:03025-1 |
| SLES 15 SP7 | javaparser | 3.28.2-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | javassist | 3.29.2-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | jdepend | 2.10-150200.11.6.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | junit5 | 5.14.4-150200.3.15.15 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | junit5-minimal | 5.14.4-150200.3.15.10 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | maven-surefire | 3.5.6-150200.3.9.23.28 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | maven-surefire-plugins | 3.5.6-150200.3.9.23.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | objectweb-asm | 9.10.1-150200.3.20.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | opentest4j | 1.2.0-150200.3.6.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | picocli | 4.7.6-150200.3.19.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-archiver | 4.14.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-build-api0 | 0.0.8-150200.5.8.7 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-cipher | 2.1.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-classworlds | 2.12.1-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-compiler | 2.17.1-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-containers +1 | 2.2.0-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-interpolation | 1.30.0-150200.3.12.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-io | 3.8.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-languages | 1.6.0-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-sec-dispatcher | 2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-utils | 4.1.0-150200.3.17.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | plexus-xml | 3.1.0-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | qdox | 2.0.1-150200.3.6.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | univocity-parsers | 2.9.1-150200.3.9.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP7 | zstd-jni | 1.5.7.16-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | ant +3 | 1.10.18-150200.4.31.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | ant-contrib | 1.0b3-150200.11.17.1 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | antlr | 2.7.7-150200.18.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | assertj-core | 3.27.7-150200.5.11.8 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | bsf | 2.4.0-150200.13.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | byte-buddy | 1.18.8-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | jakarta-activation | 2.1.0-150200.5.7.1 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | jakarta-mail | 2.1.0-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | javamail | 1.6.2-150200.3.7.1 | SUSE-SU-2025:03025-1 |
| SLES 15 SP6 | javaparser | 3.28.2-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | javassist | 3.29.2-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | jdepend | 2.10-150200.11.6.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | junit5 | 5.14.4-150200.3.15.15 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | junit5-minimal | 5.14.4-150200.3.15.10 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | maven-surefire | 3.5.6-150200.3.9.23.28 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | maven-surefire-plugins | 3.5.6-150200.3.9.23.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | objectweb-asm | 9.10.1-150200.3.20.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | opentest4j | 1.2.0-150200.3.6.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | picocli | 4.7.6-150200.3.19.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-archiver | 4.14.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-build-api | 1.2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-build-api0 | 0.0.8-150200.5.8.7 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-cipher | 2.1.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-classworlds | 2.12.1-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-compiler | 2.17.1-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-containers +1 | 2.2.0-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-interpolation | 1.30.0-150200.3.12.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-io | 3.8.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-languages | 1.6.0-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-sec-dispatcher | 2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-utils | 4.1.0-150200.3.17.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | plexus-xml | 3.1.0-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | qdox | 2.0.1-150200.3.6.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | univocity-parsers | 2.9.1-150200.3.9.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP6 | zstd-jni | 1.5.7.16-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | ant +3 | 1.10.18-150200.4.31.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | ant-contrib | 1.0b3-150200.11.17.1 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | antlr | 2.7.7-150200.18.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | apache-commons-digester3 | 3.2-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | assertj-core | 3.27.7-150200.5.11.8 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | bsf | 2.4.0-150200.13.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | byte-buddy | 1.18.8-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | jakarta-activation | 2.1.0-150200.5.7.1 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | jakarta-mail | 2.1.0-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | javaparser | 3.28.2-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | javassist | 3.29.2-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | jdepend | 2.10-150200.11.6.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | json-simple | 2.3.1-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | junit5 | 5.14.4-150200.3.15.15 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | junit5-minimal | 5.14.4-150200.3.15.10 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | maven-doxia | 2.1.0-150200.4.21.15 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | maven-doxia-sitetools | 2.1.0-150200.3.23.17 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | maven-surefire | 3.5.6-150200.3.9.23.28 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | maven-surefire-plugins | 3.5.6-150200.3.9.23.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | objectweb-asm | 9.10.1-150200.3.20.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | opentest4j | 1.2.0-150200.3.6.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | picocli | 4.7.6-150200.3.19.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-archiver | 4.14.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-build-api0 | 0.0.8-150200.5.8.7 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-cipher | 2.1.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-classworlds | 2.12.1-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-compiler | 2.17.1-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-containers +1 | 2.2.0-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-i18n +1 | 1.2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-interactivity | 1.6.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-interpolation | 1.30.0-150200.3.12.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-io | 3.8.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-languages | 1.6.0-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-sec-dispatcher | 2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-utils | 4.1.0-150200.3.17.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-velocity | 2.4.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | plexus-xml | 3.1.0-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | qdox | 2.0.1-150200.3.6.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | univocity-parsers | 2.9.1-150200.3.9.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | velocity-tools | 3.2-150200.5.3.10 | SUSE-SU-2026:4677-1 |
| SLES 15 SP5 | zstd-jni | 1.5.7.16-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | ant +3 | 1.10.18-150200.4.31.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | ant-contrib | 1.0b3-150200.11.17.1 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | antlr | 2.7.7-150200.18.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | apache-commons-digester3 | 3.2-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | assertj-core | 3.27.7-150200.5.11.8 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | bsf | 2.4.0-150200.13.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | byte-buddy | 1.18.8-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | jakarta-activation | 2.1.0-150200.5.7.1 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | jakarta-mail | 2.1.0-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | javaparser | 3.28.2-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | javassist | 3.29.2-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | jdepend | 2.10-150200.11.6.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | json-simple | 2.3.1-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | junit5 | 5.14.4-150200.3.15.15 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | junit5-minimal | 5.14.4-150200.3.15.10 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | maven-doxia | 2.1.0-150200.4.21.15 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | maven-doxia-sitetools | 2.1.0-150200.3.23.17 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | maven-surefire | 3.5.6-150200.3.9.23.28 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | maven-surefire-plugins | 3.5.6-150200.3.9.23.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | objectweb-asm | 9.10.1-150200.3.20.3 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | opentest4j | 1.2.0-150200.3.6.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | picocli | 4.7.6-150200.3.19.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-archiver | 4.14.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-build-api0 | 0.0.8-150200.5.8.7 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-cipher | 2.1.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-classworlds | 2.12.1-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-compiler | 2.17.1-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-containers +1 | 2.2.0-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-i18n +1 | 1.2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-interactivity | 1.6.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-interpolation | 1.30.0-150200.3.12.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-io | 3.8.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-languages | 1.6.0-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-sec-dispatcher | 2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-utils | 4.1.0-150200.3.17.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-velocity | 2.4.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | plexus-xml | 3.1.0-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | qdox | 2.0.1-150200.3.6.2 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | univocity-parsers | 2.9.1-150200.3.9.4 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | velocity-tools | 3.2-150200.5.3.10 | SUSE-SU-2026:4677-1 |
| SLES 15 SP4 | zstd-jni | 1.5.7.16-150200.5.7.2 | SUSE-SU-2026:4677-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | ant +3 | 1.10.18-150200.4.31.3 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | ant-contrib | 1.0b3-150200.11.17.1 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | antlr | 2.7.7-150200.18.10.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | apache-commons-digester3 | 3.2-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | assertj-core | 3.27.7-150200.5.11.8 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | bsf | 2.4.0-150200.13.8.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | byte-buddy | 1.18.8-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | jakarta-activation | 2.1.0-150200.5.7.1 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | jakarta-mail | 2.1.0-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | javaparser | 3.28.2-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | javassist | 3.29.2-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | jdepend | 2.10-150200.11.6.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | json-simple | 2.3.1-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | junit5 | 5.14.4-150200.3.15.15 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | junit5-minimal | 5.14.4-150200.3.15.10 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | maven-doxia | 2.1.0-150200.4.21.15 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | maven-doxia-sitetools | 2.1.0-150200.3.23.17 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | maven-surefire | 3.5.6-150200.3.9.23.28 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | maven-surefire-plugins | 3.5.6-150200.3.9.23.3 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | objectweb-asm | 9.10.1-150200.3.20.3 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | opentest4j | 1.2.0-150200.3.6.4 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | picocli | 4.7.6-150200.3.19.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-archiver | 4.14.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-build-api0 | 0.0.8-150200.5.8.7 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-cipher | 2.1.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-classworlds | 2.12.1-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-compiler | 2.17.1-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-containers +1 | 2.2.0-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-i18n +1 | 1.2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-interactivity | 1.6.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-interpolation | 1.30.0-150200.3.12.4 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-io | 3.8.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-languages | 1.6.0-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-sec-dispatcher | 2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-utils | 4.1.0-150200.3.17.2 | SUSE-SU-2026:4677-1 |
| SLES for SAP 15 SP4 | plexus-velocity | 2.4.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | ant +3 | 1.10.18-150200.4.31.3 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | ant-contrib | 1.0b3-150200.11.17.1 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | antlr | 2.7.7-150200.18.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | apache-commons-digester3 | 3.2-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | assertj-core | 3.27.7-150200.5.11.8 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | bsf | 2.4.0-150200.13.8.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | byte-buddy | 1.18.8-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | jakarta-activation | 2.1.0-150200.5.7.1 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | jakarta-mail | 2.1.0-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | javaparser | 3.28.2-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | javassist | 3.29.2-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | jdepend | 2.10-150200.11.6.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | json-simple | 2.3.1-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | junit5 | 5.14.4-150200.3.15.15 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | junit5-minimal | 5.14.4-150200.3.15.10 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | maven-doxia | 2.1.0-150200.4.21.15 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | maven-doxia-sitetools | 2.1.0-150200.3.23.17 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | maven-surefire | 3.5.6-150200.3.9.23.28 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | maven-surefire-plugins | 3.5.6-150200.3.9.23.3 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | objectweb-asm | 9.10.1-150200.3.20.3 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | opentest4j | 1.2.0-150200.3.6.4 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | picocli | 4.7.6-150200.3.19.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-archiver | 4.14.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-build-api0 | 0.0.8-150200.5.8.7 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-cipher | 2.1.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-classworlds | 2.12.1-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-compiler | 2.17.1-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-containers +1 | 2.2.0-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-i18n +1 | 1.2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-interactivity | 1.6.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-interpolation | 1.30.0-150200.3.12.4 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-io | 3.8.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-languages | 1.6.0-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-sec-dispatcher | 2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-utils | 4.1.0-150200.3.17.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-velocity | 2.4.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | plexus-xml | 3.1.0-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | qdox | 2.0.1-150200.3.6.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | univocity-parsers | 2.9.1-150200.3.9.4 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | velocity-tools | 3.2-150200.5.3.10 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP5 | zstd-jni | 1.5.7.16-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | ant +3 | 1.10.18-150200.4.31.3 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | ant-contrib | 1.0b3-150200.11.17.1 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | antlr | 2.7.7-150200.18.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | apache-commons-digester3 | 3.2-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | assertj-core | 3.27.7-150200.5.11.8 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | bsf | 2.4.0-150200.13.8.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | byte-buddy | 1.18.8-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | jakarta-activation | 2.1.0-150200.5.7.1 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | jakarta-mail | 2.1.0-150200.5.7.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | javaparser | 3.28.2-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | javassist | 3.29.2-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | jdepend | 2.10-150200.11.6.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | json-simple | 2.3.1-150200.5.3.5 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | junit5 | 5.14.4-150200.3.15.15 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | junit5-minimal | 5.14.4-150200.3.15.10 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | maven-doxia | 2.1.0-150200.4.21.15 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | maven-doxia-sitetools | 2.1.0-150200.3.23.17 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | maven-surefire | 3.5.6-150200.3.9.23.28 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | maven-surefire-plugins | 3.5.6-150200.3.9.23.3 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | objectweb-asm | 9.10.1-150200.3.20.3 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | opentest4j | 1.2.0-150200.3.6.4 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | picocli | 4.7.6-150200.3.19.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-archiver | 4.14.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-build-api0 | 0.0.8-150200.5.8.7 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-cipher | 2.1.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-classworlds | 2.12.1-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-compiler | 2.17.1-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-containers +1 | 2.2.0-150200.3.12.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-i18n +1 | 1.2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-interactivity | 1.6.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-interpolation | 1.30.0-150200.3.12.4 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-io | 3.8.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-languages | 1.6.0-150200.3.8.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-sec-dispatcher | 2.0-150200.3.10.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-utils | 4.1.0-150200.3.17.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-velocity | 2.4.0-150200.3.13.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | plexus-xml | 3.1.0-150200.5.13.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | qdox | 2.0.1-150200.3.6.2 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | univocity-parsers | 2.9.1-150200.3.9.4 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | velocity-tools | 3.2-150200.5.3.10 | SUSE-SU-2026:4677-1 |
| SLE HPC 15 SP4 | zstd-jni | 1.5.7.16-150200.5.7.2 | SUSE-SU-2026:4677-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ant | 1.10.18-1.1 | openSUSE-SU-2026:11763-1 |
| openSUSE Tumbleweed | javamail | 1.6.2-3.1 | openSUSE-SU-2025:15378-1 |
| openSUSE Leap 16.0 | ant +3 | 1.10.18-160000.1.1 | openSUSE-SU-2026:21891-1 |
| openSUSE Leap 15.6 | javamail | 1.6.2-150200.3.7.1 | SUSE-SU-2025:03025-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | jakarta-mail | 1.6.5-8.amzn2023.0.2 | ALAS2023-2025-1117 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-nifi +2 | 2.5.0-r2 | — |
| Wolfi rolling | apicurio-registry +2 | 3.0.11-r1 | — |
| Wolfi rolling | dependency-track +1 | 4.13.3-r1 | — |
| Wolfi rolling | jenkins-2-openjdk-21 | 2.544-r1 | — |
| Wolfi rolling | keycloak-config-cli +2 | 6.4.0-r48 | — |
| Wolfi rolling | sonarqube | 26.8.0.126808-r0 | — |
| Wolfi rolling | thingsboard-tb-node | 4.3.1.1-r4 | — |
| Wolfi rolling | wildfly +4 | 36.0.1-r8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.sun.mail:jakarta.mail | < 1.6.8 | 1.6.8 | GHSA-9342-92gg-6v29 |
| Maven | com.sun.mail:jakarta.mail | >= 2.0.0, < 2.0.2 | 2.0.2 | GHSA-9342-92gg-6v29 |
| Maven | org.eclipse.angus:smtp | < 2.0.4 | 2.0.4 | GHSA-9342-92gg-6v29 |
Advisories 21
- WID-SEC-2026-1210 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- NCSC-2026-0448 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Oct 22, 2026
- WID-SEC-2026-4078 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- SUSE-SU-2026:4677-1 Security update for the Java stack SUSE / openSUSE Security Updates · Oct 15, 2026
- WID-SEC-2026-2444 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 7, 2026
- openSUSE-SU-2026:21891-1 Security update for ant SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:11763-1 ant-1.10.18-1.1 on GA media SUSE / openSUSE Security Updates · Sep 13, 2026
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- WID-SEC-2026-2430 Oracle Database Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-1551 Shibboleth Identity Provider: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2026
- WID-SEC-2025-1870 Keycloak: Schwachstelle ermöglicht Versand beliebiger E-Mails BSI CERT-Bund (WID) · May 12, 2026
- WID-SEC-2026-1206 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- SUSE-SU-2025:03025-1 Security update for javamail SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15378-1 javamail-1.6.2-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0166 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2499 IBM WebSphere Application Server: Schwachstelle ermöglicht Manipulation von Dateien und potenziell Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2853 HCL Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 15, 2025
- WID-SEC-2025-2361 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- WID-SEC-2025-1966 Jenkins Plugins: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Sep 3, 2025
- ALAS2023-2025-1117 Important: jakarta-mail security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 8, 2025