RHLW-2026-c45d2a64e2c0626e

See a problem?
Please try reporting it to the source first.

Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-c45d2a64e2c0626e.json

Import Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-c45d2a64e2c0626e.json

JSON Data

https://api.osv.dev/v1/vulns/RHLW-2026-c45d2a64e2c0626e

Upstream

Published

2026-10-08T19:45:15Z

Modified

2026-10-27T04:00:13Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

Lightwell Security Advisory: android-mail 1.6.7.rhlw-00001

Details

Red Hat Lightwell has released com.sun.mail:android-mail 1.6.7.rhlw-00001 with a backported security fix.

CVE-2025-7962: In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

This patched artifact is a drop-in replacement for com.sun.mail:android-mail 1.6.7 from Maven Central.

References

Credits

- Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / com.sun.mail:android-mail

Package

Name: com.sun.mail:android-mail
Purl: pkg:maven/com.sun.mail/android-mail

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.7.rhlw-00001

Affected versions

1.*

1.5.5

1.5.6

1.6.0-rc1

1.6.0-rc2

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

Database specific

lightwell

{
    "backport_base_version":  "1.6.7",
    "remediated_version":  "1.6.7.rhlw-00001",
    "repository_url":  "https://packages.redhat.com/lightwell/java/remediated/"
}

source

"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-c45d2a64e2c0626e.json"