# Jakarta.mail dependency downgraded

**URL:** <https://discuss.elastic.co/t/jakarta-mail-dependency-downgraded/390039>\
**Category:** Elasticsearch\
**Created:** [September 1, 2026, 11:25am UTC](https://discuss.elastic.co/t/jakarta-mail-dependency-downgraded/390039 "2026-09-01T11:25:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![manick02](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@manick02](https://discuss.elastic.co/u/manick02)\
**Post date:** [September 1, 2026, 11:25am UTC](https://discuss.elastic.co/t/jakarta-mail-dependency-downgraded/390039/1 "2026-09-01T11:25:21Z")

</div>

I noticed jakarta.mail dependency downgraded from 1.6.8( in 8.18.6 )to 1.6.3 (in 8.19.20)

> <https://github.com/elastic/elasticsearch/blob/v8.18.6/x-pack/plugin/security/build.gradle#L93>

> <https://github.com/elastic/elasticsearch/blob/v8.19.20/x-pack/plugin/security/build.gradle#L91>

We were tracking the CVE CVE-2025-7962 internally and was wondering if this downgrade made it open it again

---

<div class="post-metadata">

**Author:** ![Keith\_Massey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keith_massey/32/83666_2.png) [@Keith\_Massey](https://discuss.elastic.co/u/Keith_Massey)\
**Post date:** [September 1, 2026, 6:08pm UTC](https://discuss.elastic.co/t/jakarta-mail-dependency-downgraded/390039/2 "2026-09-01T18:08:07Z")

</div>

I don't think it was downgraded. It just looks like an oversight that it was backported to 8.18 but not 8.19. [bump Jakarta Mail by ankit--sethi · Pull Request #133240 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/pull/133240). The change needs to be ported to 8.19.

---

<div class="post-metadata">

**Author:** ![Elliot\_Barlas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elliot_barlas/32/147644_2.png) [@Elliot\_Barlas](https://discuss.elastic.co/u/Elliot_Barlas)\
**Post date:** [September 1, 2026, 8:11pm UTC](https://discuss.elastic.co/t/jakarta-mail-dependency-downgraded/390039/3 "2026-09-01T20:11:07Z")

</div>

It was indeed an oversight.

PR [elasticsearch#158317](https://github.com/elastic/elasticsearch/pull/158317) just merged with the Jakarta Mail 1.6.8 version bump.

It will be included in the upcoming 8.19.22 release.