Is org.apache.james:james-server safe ? org.apache.james:james-server (maven) has 11 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 68th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-px7w-c9gw-7gj3, the advisory selected below
// 11 advisories GHSA-px7w-c9gw-7gj3 Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. CRIT GHSA-c38m-7h53-g9v4 Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any… CRIT GHSA-p5q9-86w4-2xr5 Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. HIGH GHSA-w45j-f5g5-w94x Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. HIGH GHSA-cgvf-22vv-83h5 Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors. HIGH GHSA-r58x-wjg8-63m9 In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable… HIGH GHSA-v6vp-62vc-84qw Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. MODE GHSA-92j7-34x9-f3jw Spooler in Apache Foundation James before 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in… MODE GHSA-v84g-cf5j-xjqx Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. MODE GHSA-fqgw-6qj5-8hmp In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite… MODE GHSA-84wg-rgp8-2hg4 Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. MODE Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High // questions Is org.apache.james:james-server safe to install? CyberXYZ does not call a package safe in absolute terms. It records 11 known vulnerabilities for org.apache.james:james-server (maven), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does org.apache.james:james-server have known vulnerabilities? Yes. CyberXYZ records 11 known vulnerabilities for org.apache.james:james-server (maven), the worst rated CRITICAL. These include GHSA-px7w-c9gw-7gj3, GHSA-c38m-7h53-g9v4, GHSA-p5q9-86w4-2xr5, GHSA-w45j-f5g5-w94x, GHSA-cgvf-22vv-83h5.
How do I check org.apache.james:james-server before installing? Search org.apache.james:james-server in CyberXYZ Check at https://cyberxyz.io/check?q=org.apache.james%3Ajames-server . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:19 UTC. The most recent advisory here was published 2024-02-27. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page