RHLW-2026-49443da84312bd4d

See a problem?
Please try reporting it to the source first.

Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-49443da84312bd4d.json

Import Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-49443da84312bd4d.json

JSON Data

https://api.osv.dev/v1/vulns/RHLW-2026-49443da84312bd4d

Upstream

Published

2026-09-09T18:42:50Z

Modified

2026-10-27T04:00:14Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

Lightwell Security Advisory: jakarta.mail 1.6.7.rhlw-00001

Details

Red Hat Lightwell has released com.sun.mail:jakarta.mail 1.6.7.rhlw-00001 with a backported security fix.

CVE-2025-7962: In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

This patched artifact is a drop-in replacement for com.sun.mail:jakarta.mail 1.6.7 from Maven Central.

References

Credits

- Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / com.sun.mail:jakarta.mail

Package

Name: com.sun.mail:jakarta.mail
Purl: pkg:maven/com.sun.mail/jakarta.mail

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.7.rhlw-00001

Affected versions

1.*

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

Database specific

lightwell

{
    "backport_base_version":  "1.6.7",
    "remediated_version":  "1.6.7.rhlw-00001",
    "repository_url":  "https://packages.redhat.com/lightwell/java/remediated/"
}

source

"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-49443da84312bd4d.json"