Vulnerability · high
CVE-2026-85108: Apache James MIME4J resource allocation denial of service
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Projects using Apache Mime4J Core or Dom before 0.8.15
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
What to do
- Upgrade apache-mime4j-core and apache-mime4j-dom to 0.8.15 or later
The Brief
- CVE-2026-85108 is a denial-of-service flaw caused by allocation of resources without limits or throttling in Apache James MIME4J.
- Affected are Apache James Mime4J Core and Mime4J Dom versions before 0.8.15.
- The advisory was posted to oss-sec on 2026-11-06 by Benoit Tellier and rated important.
Why it matters
Applications that parse MIME messages with Mime4J Core or Dom before 0.8.15 can be driven into resource exhaustion, so teams using these libraries should upgrade.
The checklist behind the tier
Checklist · 1 of 10 yes
| Yes | Hits tech teams | Judgment: Mime4J is a Java library developers build mail-handling software with. |
| No | Core infrastructure | Judgment: a single parsing library, not shared core infrastructure like OpenSSH or glibc. |
| No | Popular tool | Judgment: Mime4J is a specialised MIME parsing library, not a mainstream framework or platform. |
| No | Exploited in the wild | Open Source Security (2026-11-06): advisory describes a DoS flaw; no observed attacks reported. |
| No | Public exploit | Open Source Security (2026-11-06): only an advisory is given; no exploit or PoC mentioned. |
| No | Remote, no login | Open Source Security (2026-11-06): excerpt does not state whether unauthenticated network access is possible. |
| No | Full takeover | Open Source Security (2026-11-06): issue is denial of service from unbounded resource allocation, not code execution. |
| No | Secrets exposed | Open Source Security (2026-11-06): no data theft or exposure mentioned. |
| No | Supply chain | Open Source Security (2026-11-06): a normal vulnerability in legitimate code; no compromised package or pipeline. |
| No | No fix yet | Open Source Security (2026-11-06): affected versions are 'before 0.8.15', implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-770
Timeline
Vulnerability disclosed on oss-sec
Open Source Security
CVE-2026-85108: Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling
Source
CVE-2026-85108: Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided