High severity · published Feb 6, 2025
CVE-2024-37358
Apache James: denial of service through the use of IMAP literals
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations
Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AJ
Apache James server · Apache Software Foundation
through 3.7.5; 3.8.0 through 3.8.1 · source: vendor
JS
James Server · Apache
before 3.7.6; 3.8.0 before 3.8.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37358
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37358
Mailing List
https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc
More from Apache James server
9.8
CVE-2023-51518
Apache James server: Privilege escalation via JMX pre-authentication deserialisation
7.8
CVE-2023-26269
Apache James server: Privilege escalation through unauthenticated JMX
7.5
CVE-2024-45626
Apache James: denial of service through JMAP HTML to text conversion
7.1
CVE-2023-51747
SMTP smuggling in Apache James
5.5
CVE-2022-45935
Apache James server: Temporary File Information Disclosure