The Morning Dev

Only the news worth knowing

‹
 
C22/100

Vulnerability · high · CVSS 8.7

CVE-2026-85111: Apache James denial of service during MIME parsing

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Apache James servers before 3.9.1 parsing untrusted MIME messages

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Remote, no login

What to do

  1. Upgrade Apache James to 3.9.1 or later

The Brief

  • CVE-2026-85111 is a denial-of-service vulnerability in Apache James during MIME parsing.
  • Affected versions are Apache James before 3.9.1.
  • The issue lies in the Apache Mime4J library, with the description citing allocation of resources without limits or throttling. The source lists CVSS 4.0 8.7 (high), network-reachable with no privileges or user interaction, and high availability impact.

Why it matters

Mail servers running Apache James before 3.9.1 can be made unavailable by crafted MIME input, so operators should upgrade to 3.9.1 or later.

The checklist behind the tier

Checklist · 2 of 10 yes
YesHits tech teamsApache James is a mail server; mail servers are infrastructure developers and ops teams run.
NoCore infrastructureApache James is a single mail server product, not software nearly every team runs.
NoPopular toolApache James is a niche mail server, not a widely used framework or mainstream developer tool.
NoExploited in the wildOpen Source Security advisory describes the DoS flaw only; no observed attacks reported.
NoPublic exploitOpen Source Security advisory only; no exploit code or proof-of-concept mentioned.
YesRemote, no loginCVSSCVE-2026-85111: CVSS 8.7 – network, no privileges, no user interaction
NoFull takeoverCVSSCVSS: no CVE has both high confidentiality and integrity impact
NoSecrets exposedOpen Source Security describes denial of service only; no data exposure reported.
NoSupply chainOpen Source Security describes a normal vulnerability in legitimate code; no malicious code shipped.
NoNo fix yetOpen Source Security says affected versions are before 3.9.1 but does not state that no fix exists.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-85111 ↗CVSS 8.7 high AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

    Apache James: Denial of service upon MIME parsing

    Exploited
    Not in CISA’s exploited catalog
    Weakness
    CWE-770

    NVDGHSA-4fm7-jr3j-gv7f

Timeline

  1. Vulnerability disclosed on the Open Source Security list by Benoit Tellier

  2. Open Source Security

    CVE-2026-85111: Apache James: Denial of service upon MIME parsing

Source

CVE-2026-85111: Apache James: Denial of service upon MIME parsing ↗ Open Source Security · 2h ago

First seen · 1 source · Full story page · How tiers are decided