-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.james:james-server-jmap-draft | maven | >= 3.8.0, < 3.8.2 | 3.8.2 |
| org.apache.james:james-server-jmap-draft | maven | < 3.7.6 | 3.7.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from HTML-to-text conversion logic. The commit diff shows a critical change in the flatten() method - replacing recursion with a Deque-based iterative approach. The original recursive implementation (flatten(Node base, int listNestedLevel)) would create unbounded stack growth for deeply nested HTML, leading to denial of service. The added test case 'deeplyNestedHtmlShouldNotThrowStackOverflow' confirms this was the vulnerable path. The CWE-400 classification (uncontrolled resource consumption) aligns with the recursion-induced memory exhaustion scenario fixed by this change.
Ongoing coverage of React2Shell