Skip to content
Sign in
8.7 High

CVE-2026-85111 Apache James: Denial of service upon MIME parsing

Description

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue. See CVE-2026-85108 in Apache James MIME4J library.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
None
Confidentiality
None
Integrity
None
Availability
High
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
Apache James 3.9 earliest → < 3.9.1 3.9.1

Other CVEs of Apache James

The 13 CVEs of Apache James →
CVE-2026-76168 Apache James: ManageSieve file implementation cross-user path traversal Not rated CVE-2026-74756 Apache James: WebAdmin exposed without authentication on official Docker default Not rated CVE-2026-76171 Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client Not rated CVE-2026-49939 Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol Not rated
Track this CVE