CVE-2024-37358

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations

Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Feb 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-373598.6The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficie CVE-2024-37367.5A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the func CVE-2024-373604.4Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2024-373619.9The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi CVE-2024-373626.3The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception CVE-2024-373636.5The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitac CVE-2024-373646.8Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensi CVE-2024-373657.8A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public dire CVE-2024-373677.5A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remot CVE-2024-373687.5A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote sy CVE-2024-373698.8A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing CVE-2024-37379.8A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been rated as critical. Affected by this issue is the function findCount