How severe is CVE-2023-51747?

CVE-2023-51747 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability none.

Is CVE-2023-51747 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-51747?

CVE-2023-51747 primarily affects Apache James. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-51747?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2023-51747 have an EU (EUVD) identifier?

Yes. CVE-2023-51747 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0681.

When was CVE-2023-51747 published?

CVE-2023-51747 was published on 2024-02-27 and last updated on 2026-06-17.

CVE-2023-51747

CVE-2023-51747 is a high-severity vulnerability in Apache James with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

Severity: High (CVSS 3.x base score 7.1)
EPSS exploit prediction: 1% (60th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-0681
Weakness: CWE-20
Affected product: Apache James
Published: 2024-02-27
Last modified: 2026-06-17

Description

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks. The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction. We recommend James users to upgrade to non vulnerable versions.

Frequently asked questions

What is CVE-2023-51747?: Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks. The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction. We recommend James users to upgrade to non vulnerable versions.
How severe is CVE-2023-51747?: CVE-2023-51747 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability none.
Is CVE-2023-51747 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-51747?: CVE-2023-51747 primarily affects Apache James. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-51747?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2023-51747 have an EU (EUVD) identifier?: Yes. CVE-2023-51747 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0681.
When was CVE-2023-51747 published?: CVE-2023-51747 was published on 2024-02-27 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:apache:james:3.7.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:james:3.8.1:*:*:*:*:*:*:*

More vulnerabilities in Apache James

CVE-2023-51518 — Critical (CVSS 9.8): Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication…
CVE-2019-0228 — Critical (CVSS 9.8): Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct…
CVE-2021-40525 — Critical (CVSS 9.1): Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
CVE-2023-26269 — High (CVSS 7.8): Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This…
CVE-2006-2806 — High (CVSS 7.8): The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a…
CVE-2022-28220 — High (CVSS 7.5): Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS…

All CVEs affecting Apache James →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →