CVE-2024-37358CWE-770

Apache James: denial of service through the use of IMAP literals

High · published February 6, 2025

CVSS v3.1
8.6
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations

Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00888 · 59.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-02-06T11:22Z
EPSS history
Timeline
  • 06 FEB 11:22Z
    Apache James: denial of service through the use of IMAP literals
    cvelistv5