Vulnerability in Eclipse Foundation Jakarta Mail

[ Description ]Official description

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL22 Oct 2026NCSC-2026-0448

  Vulnerabilities fixed in Oracle Fusion Middleware Translated from Dutch

  Probability/damage H/HCVE-2026-54513CVE-2026-56741CVE-2026-59649+191 more CVEs
• CERT-FR21 Oct 2026CERTFR-2026-AVI-1355

  Multiple vulnerabilities in Oracle Weblogic Translated from French

  Multiple vulnerabilities have been discovered in Oracle Weblogic. They allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

  CVE-2026-41855CVE-2026-59645CVE-2026-41853+26 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4078

  Oracle Fusion Middleware: Multiple vulnerabilities Translated from German

  CVE-2026-91212CVE-2023-43622CVE-2026-42779+191 more CVEs

[ References ]References

• gitlab.eclipse.org/security/cve-assignement/-/issues/67