Vulnerability details
CVE-2024-37358
Apache Software Foundation Apache James server
Apache James: denial of service through the use of IMAP literals
CVSS 3.1
8.6High
Official description
Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 3.1 | CVEProject cvelistV5 (CNA) (apache) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Apache Software Foundation | Apache James server | v ≤ 3.7.5 | CVEProject cvelistV5 (CNA) |
| Apache Software Foundation | Apache James server | 3.8.0 ≤ v ≤ 3.8.1 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-02-06
- Last updated
- 2025-09-01
- State
- Published
- Assigner (CNA)
- apache
Exploit prediction (EPSS)
0.88%
Probability of exploitation in 30 days
59.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-770Allocation of Resources Without Limits or Throttling