CVE-2021-40110

Denial of Service in Apache James

Summary

Original description

The description as published by the source.

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Maven org.apache.james:james-server

[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.6.1"}]}]

References

advisory nvd.nist.gov
web openwall.com
web openwall.com