CVE-2024-21742
Apache James Mime4J: Mime4J DOM header injection
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
- Record
CVE-2024-21742- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List
Apache James Mime4J: Mime4J DOM header injection
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
- Record
CVE-2024-21742- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2024-0666
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
- Record
EUVD-2024-0666- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jw7r-rxff-gv24
Apache James MIME4J improper input validation vulnerability
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
- Record
GHSA-jw7r-rxff-gv24- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20, CWE-74
- Updated
- 2026-11-02
OSV
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
- Record
CVE-2024-21742- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-21742
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
- Record
DEBIAN-CVE-2024-21742- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-jw7r-rxff-gv24
Apache James MIME4J improper input validation vulnerability
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
- Record
GHSA-jw7r-rxff-gv24- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20, CWE-74
- Updated
- 2026-11-02
OSVOESA-2024-1333
apache-mime4j security update
Java stream based MIME message parser.
Security Fix(es):
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. (CVE-2024-21742)
- Record
OESA-2024-1333- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2024-1475
apache-mime4j security update
Java stream based MIME message parser.
Security Fix(es):
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. (CVE-2024-21742)
- Record
OESA-2024-1475- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2024-1476
apache-mime4j security update
Java stream based MIME message parser.
Security Fix(es):
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. (CVE-2024-21742)
- Record
OESA-2024-1476- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2024-1477
apache-mime4j security update
Java stream based MIME message parser.
Security Fix(es):
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. (CVE-2024-21742)
- Record
OESA-2024-1477- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2024-1478
apache-mime4j security update
Java stream based MIME message parser.
Security Fix(es):
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. (CVE-2024-21742)
- Record
OESA-2024-1478- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2024-1479
apache-mime4j security update
Java stream based MIME message parser.
Security Fix(es):
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. (CVE-2024-21742)
- Record
OESA-2024-1479- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHLW-2026-0436667cee7724a6
Lightwell Security Advisory: apache-mime4j-dom 0.8.9.rhlw-00004
Red Hat Lightwell has released org.apache.james:apache-mime4j-dom 0.8.9.rhlw-00004 with a backported security fix.
CVE-2024-21742: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
This patched artifact is a drop-in replacement for org.apache.james:apache-mime4j-dom 0.8.9 from Maven Central.
- Record
RHLW-2026-0436667cee7724a6- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRHLW-2026-e78d277bde69c3f5
Lightwell Security Advisory: apache-mime4j-core 0.8.9.rhlw-00004
Red Hat Lightwell has released org.apache.james:apache-mime4j-core 0.8.9.rhlw-00004 with a backported security fix.
CVE-2024-21742: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
This patched artifact is a drop-in replacement for org.apache.james:apache-mime4j-core 0.8.9 from Maven Central.
- Record
RHLW-2026-e78d277bde69c3f5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-21742
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
- Record
UBUNTU-CVE-2024-21742- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.james:apache-mime4j-coreMaven |
before 0.8.10 | 0.8.10 |
apache-mime4jDebian:12 |
All versions, plus listed versions 0.8.10-10.8.11-10.8.12-10.8.13-10.8.2-1 |
None known |
apache-mime4jDebian:13 |
before 0.8.10-1 | 0.8.10-1 |
apache-mime4jDebian:14 |
before 0.8.10-1 | 0.8.10-1 |
org.apache.james:apache-mime4j-coreMaven |
before 0.8.10, plus listed versions 0.70.7.10.7.20.8.00.8.1 Show 8 moreShow less0.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.9 |
0.8.10 |
apache-mime4jopenEuler:22.03-LTS-SP3 |
before 0.8.3-2.oe2203sp3 | 0.8.3-2.oe2203sp3 |
apache-mime4jopenEuler:22.03-LTS |
before 0.8.1-3.oe2203 | 0.8.1-3.oe2203 |
apache-mime4jopenEuler:22.03-LTS-SP1 |
before 0.8.3-2.oe2203sp1 | 0.8.3-2.oe2203sp1 |
apache-mime4jopenEuler:22.03-LTS-SP2 |
before 0.8.3-2.oe2203sp2 | 0.8.3-2.oe2203sp2 |
apache-mime4jopenEuler:20.03-LTS-SP1 |
before 0.8.1-2.oe1 | 0.8.1-2.oe1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
apache-mime4jopenEuler:20.03-LTS-SP4 |
before 0.8.1-2.oe2003sp4 | 0.8.1-2.oe2003sp4 |
org.apache.james:apache-mime4j-domRed Hat Lightwell:Maven |
before 0.8.9.rhlw-00004, plus listed versions 0.70.7.10.7.20.8.00.8.1 Show 8 moreShow less0.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.9 |
0.8.9.rhlw-00004 |
org.apache.james:apache-mime4j-coreRed Hat Lightwell:Maven |
before 0.8.9.rhlw-00004, plus listed versions 0.70.7.10.7.20.8.00.8.1 Show 8 moreShow less0.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.9 |
0.8.9.rhlw-00004 |
apache-mime4jUbuntu:16.04:LTS |
All versions, plus listed versions 0.7.2-30.7.2-4 |
None known |
apache-mime4jUbuntu:18.04:LTS |
All versions, plus listed versions 0.7.2-4 |
None known |
apache-mime4jUbuntu:20.04:LTS |
All versions, plus listed versions 0.8.2-1 |
None known |
apache-mime4jUbuntu:22.04:LTS |
All versions, plus listed versions 0.8.2-1 |
None known |
apache-mime4jUbuntu:24.04:LTS |
All versions, plus listed versions 0.8.2-10.8.10-1 |
None known |
apache-mime4jUbuntu:25.10 |
All versions, plus listed versions 0.8.12-1 |
None known |
apache-mime4jUbuntu:26.10 |
All versions, plus listed versions 0.8.13-1 |
None known |
apache-mime4jUbuntu:26.04:LTS |
All versions, plus listed versions 0.8.12-10.8.13-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21742 is a medium vulnerability (CVSS 5.3) in Apache James Mime4j, published February 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in org.apache.james:apache-mime4j-core 0.8.10.
References
lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy
openwall.com/lists/oss-security/2024/02/27/5
nvd.nist.gov/vuln/detail/CVE-2024-21742
github.com/apache/james-mime4j/commit/9dec5df2a588fed8027839815daefa79ee66efd1
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2024-21742
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1333
ubuntu.com/security/CVE-2024-21742
cve.org/CVERecord?id=CVE-2024-21742