GHSA-r58x-wjg8-63m9
Denial of Service in Apache James
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.james:james-server | >= 3.1.0, < 3.6.1 | 3.6.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.
References
External links from the advisory. They lead to third-party sites.