CVE-2026-76171: Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

oss-security · 1h ago

Posted by Benoit Tellier on Nov 06 Severity: low Affected versions: - Apache James 3.9.0 before 3.9.1 Description: In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are…