CVE-2021-38542: Apache James

Medium severity, CVSS 5.9. EPSS: 2.3% chance of exploitation in the next 30 days.

Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.

Affected products

• Apache James: before 3.6.1 (fixed in 3.6.1)

Published 2022-01-04. Last modified 2026-06-17.