CVE-2022-28220

Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.

• CWE-77
• CWE-77

• http://www.openwall.com/lists/oss-security/2022/09/20/1Mailing List, Third Party Advisory
• https://james.apache.org/james/update/2022/08/26/james-3.7.1.htmlPatch, Release Notes, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/09/20/1Mailing List, Third Party Advisory
• https://james.apache.org/james/update/2022/08/26/james-3.7.1.htmlPatch, Release Notes, Vendor Advisory

Published

Sep 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28215SAP NetWeaver ABAP Server and ABAP Platform - versions 740, …4.7
• CVE-2022-28216SAP BusinessObjects Business Intelligence Platform (BI Works…6.1
• CVE-2022-28217Some part of SAP NetWeaver (EP Web Page Composer) does not s…6.5
• CVE-2022-28218An issue was discovered in CipherMail Webmail Messenger 1.1.…5.5
• CVE-2022-28219Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vuln…9.8
• CVE-2022-2822An attacker can freely brute force username and password and…7.5
• CVE-2022-28221The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vuln…6.1
• CVE-2022-28222The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vuln…6.1
• CVE-2022-28223Tekon KIO devices through 2022-03-30 allow an authenticated …7.2
• CVE-2022-28224Clusters using Calico (version 3.22.1 and below), Calico Ent…5.5
• CVE-2022-28225Local privilege vulnerability in Yandex Browser for Windows …7.8
• CVE-2022-28226Local privilege vulnerability in Yandex Browser for Windows …7.8