Non notée
CVE-2021-40111 In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP…
Description
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache James 3.6 | premières → 3.6.0 | Pas de correctif indiqué |
Références
- www.openwall.com www.openwall.com
- [oss-security] 20220104 CVE-2021-40111: Apache James IMAP parsing Denial Of Service www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache James
Les 13 CVE de Apache James →
CVE-2026-85111
Apache James: Denial of service upon MIME parsing
8.7
Élevée
CVE-2026-76168
Apache James: ManageSieve file implementation cross-user path traversal
Non notée
CVE-2026-74756
Apache James: WebAdmin exposed without authentication on official Docker default
Non notée
CVE-2026-76171
Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
Non notée