CVE-2024-37358 Apache James: denial of service through the use of IMAP literals

What is CVE-2024-37358?

CVE-2024-37358 is a high-severity denial of service vulnerability in Apache James server, published on 6 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations

Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.

Weakness: CWE-770

Which versions are affected by CVE-2024-37358?

4 open source packages ship an affected version, including org.apache.james.protocols:protocols-imap. It affects 1 product.

Products include Apache James Server.

How do I fix CVE-2024-37358?

Upgrade org.apache.james.protocols:protocols-imap to a fixed version for your release line: 3.7.6 or 3.8.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-37358 being exploited?

There is no known exploitation of CVE-2024-37358 in the wild and no public exploit code.

Other vulnerabilities in Apache James server

• CVE-2015-7611 Apache James Server OS Command Injection High 8.1
• CVE-2017-12628 Apache James Privilege Escalation High 7.8
• CVE-2024-45626 Apache James: denial of service through JMAP HTML to text conversion Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-56jp-w6vw-j3jw.