Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

greenmail-mail-test/greenmail

              master @ 63d3ca0
            

Fixes

CVEs

MEDIUM

Peak severity

16.7%

Coverage

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

greenmail-core/src/main/java/com/icegreen/greenmail/imap/commands/CommandParser.java: most-fixed (3 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

IMAP Response Injection: Inadequate handling of CR/LF characters inside quoted strings allows attackers to inject arbitrary IMAP commands or smuggle responses, altering the structure of IMAP communications.

Injection: Accepting non-atom characters in custom IMAP flag keywords allows protocol manipulation, which can lead to command hijacking or client-side parsing failures.

Denial of Service: An infinite loop in the connection request handler triggers high CPU consumption when a client disconnects unexpectedly, rendering the test server unresponsive.