CVE-2017-9801
Improper Input Validation in Apache Commons Email
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
- Record
CVE-2017-9801- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
- Record
CVE-2017-9801- Updated
- 2026-11-02
EUVDEUVD-2022-4710 No score
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
- Record
EUVD-2022-4710- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p7vm-phxx-g722
Improper Input Validation in Apache Commons Email
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
- Record
GHSA-p7vm-phxx-g722- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-p7vm-phxx-g722
Improper Input Validation in Apache Commons Email
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
- Record
GHSA-p7vm-phxx-g722- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVMGASA-2017-0322 No score
Updated apache-commons-email packages fix security vulnerability
In apache-commons-email before 1.5, when a call-site passes a subject for an email that contains line-breaks, the caller can add arbitrary SMTP headers (CVE-2017-9801).
- Record
MGASA-2017-0322- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10619-1 No score
apache-commons-email-1.5-3.10 on GA media
These are all security issues fixed in the apache-commons-email-1.5-3.10 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10619-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.commons:commons-emailMaven |
1.0 to 1.4 | 1.5 |
org.apache.commons:commons-emailMaven |
1.0 up to 1.5, plus listed versions 1.11.21.31.3.11.3.21.3.31.4 |
1.5 |
apache-commons-emailMageia:5 |
before 1.3.1-4.1.mga5 | 1.3.1-4.1.mga5 |
apache-commons-emailMageia:6 |
before 1.3.1-10.1.mga6 | 1.3.1-10.1.mga6 |
apache-commons-emailopenSUSE:Tumbleweed |
before 1.5-3.10 | 1.5-3.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9801 is a high vulnerability (CVSS 7.5) in Apache Commons Email, published August 7, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.04%, the 93rd percentile. Fixed in org.apache.commons:commons-email 1.5.
References
lists.apache.org/thread.html/7ef903a772a2ff08605df1be819044fb15df2815eb3d63878b3fbbb5%40%3Cannounce.apache.org%3E
securitytracker.com/id/1039043
securityfocus.com/bid/100082
nvd.nist.gov/vuln/detail/CVE-2017-9801
github.com/advisories/GHSA-p7vm-phxx-g722