Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-mkf8-a5k3-83fs
Vulnerability ID VCID-mkf8-a5k3-83fs
Aliases CVE-2021-44549
GHSA-c69w-jj56-834w
Summary Improper Certificate Validation Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-295 Improper Certificate Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-297 Improper Validation of Certificate with Host Mismatch
System Score Found at
cvssv3 7.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44549.json
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-44549
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-c69w-jj56-834w
cvssv3.1 7.4 https://github.com/eclipse-ee4j
generic_textual HIGH https://github.com/eclipse-ee4j
cvssv3.1 7.4 https://github.com/eclipse-ee4j/mail/issues/429
generic_textual HIGH https://github.com/eclipse-ee4j/mail/issues/429
cvssv3.1 7.4 https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html
generic_textual HIGH https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html
cvssv3.1 7.4 https://javaee.github.io/javamail/docs/SSLNOTES.txt
generic_textual HIGH https://javaee.github.io/javamail/docs/SSLNOTES.txt
cvssv3.1 7.4 https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7f
generic_textual HIGH https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7f
cvssv3.1 7.4 https://nvd.nist.gov/vuln/detail/CVE-2021-44549
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-44549
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44549.json
https://api.first.org/data/v1/epss?cve=CVE-2021-44549
https://github.com/eclipse-ee4j
https://github.com/eclipse-ee4j/mail/issues/429
https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html
https://javaee.github.io/javamail/docs/SSLNOTES.txt
https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7f
2315808 https://bugzilla.redhat.com/show_bug.cgi?id=2315808
CVE-2021-44549 https://nvd.nist.gov/vuln/detail/CVE-2021-44549
GHSA-c69w-jj56-834w https://github.com/advisories/GHSA-c69w-jj56-834w
RHSA-2024:7670 https://access.redhat.com/errata/RHSA-2024:7670
RHSA-2024:7676 https://access.redhat.com/errata/RHSA-2024:7676
RHSA-2024:8884 https://access.redhat.com/errata/RHSA-2024:8884
RHSA-2024:8885 https://access.redhat.com/errata/RHSA-2024:8885
RHSA-2024:8886 https://access.redhat.com/errata/RHSA-2024:8886
RHSA-2024:8887 https://access.redhat.com/errata/RHSA-2024:8887
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44549.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/eclipse-ee4j
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/eclipse-ee4j/mail/issues/429
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://javaee.github.io/javamail/docs/SSLNOTES.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-44549
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.40094
EPSS Score 0.00185
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:11.112481+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sling/org.apache.sling.commons.messaging.mail/CVE-2021-44549.yml 38.0.0