RHLW-2026-e78d277bde69c3f5

See a problem?
Please try reporting it to the source first.

Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-e78d277bde69c3f5.json

Import Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-e78d277bde69c3f5.json

JSON Data

https://api.test.osv.dev/v1/vulns/RHLW-2026-e78d277bde69c3f5

Upstream

Published

2026-09-28T20:42:52Z

Modified

2026-10-22T00:08:25Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Lightwell Security Advisory: apache-mime4j-core 0.8.9.rhlw-00004

Details

Red Hat Lightwell has released org.apache.james:apache-mime4j-core 0.8.9.rhlw-00004 with a backported security fix.

CVE-2024-21742: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.

This patched artifact is a drop-in replacement for org.apache.james:apache-mime4j-core 0.8.9 from Maven Central.

References

Credits

- Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.apache.james:apache-mime4j-core

Package

Name: org.apache.james:apache-mime4j-core
Purl: pkg:maven/org.apache.james/apache-mime4j-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.8.9.rhlw-00004

Affected versions

0.*

0.7

0.7.1

0.7.2

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.8.6

0.8.7

0.8.8

0.8.9

Database specific

lightwell

{
    "backport_base_version": "0.8.9",
    "remediated_version": "0.8.9.rhlw-00004",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}

source

"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-e78d277bde69c3f5.json"