CVE-2024-45626 Apache James: denial of service through JMAP HTML to text conversion

What is CVE-2024-45626?

CVE-2024-45626 is a medium-severity denial of service vulnerability in Apache James server, published on 6 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.

Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.

Weakness: CWE-400

Which versions are affected by CVE-2024-45626?

4 open source packages ship an affected version, including org.apache.james:james-server-jmap-draft. It affects 1 product.

Products include Apache James Server.

How do I fix CVE-2024-45626?

Upgrade org.apache.james:james-server-jmap-draft to a fixed version for your release line: 3.7.6 or 3.8.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-45626 being exploited?

There is no known exploitation of CVE-2024-45626 in the wild and no public exploit code.

Other vulnerabilities in Apache James server

• CVE-2024-37358 Apache James: denial of service through the use of IMAP literals High 8.6
• CVE-2015-7611 Apache James Server OS Command Injection High 8.1
• CVE-2017-12628 Apache James Privilege Escalation High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-57m2-h3fw-rxhw.