Security · High impactFan score 22 · Tier C

CVE-2026-85111: Apache James: Denial of service upon MIME parsing

The Brief

CVE-2026-85111 is a denial-of-service vulnerability in Apache James during MIME parsing.
Affected versions are Apache James before 3.9.1.
The issue lies in the Apache Mime4J library, with the description citing allocation of resources without limits or throttling. The source lists CVSS 4.0 8.7 (high), network-reachable with no privileges or user interaction, and high availability impact.

Why it matters

Mail servers running Apache James before 3.9.1 can be made unavailable by crafted MIME input, so operators should upgrade to 3.9.1 or later.

Who’s affected

Operators running Apache James before 3.9.1

What to do

Upgrade Apache James to 3.9.1 or later

Apache James 3.9.1
CVE-2026-85111
#apache-james
#mime
#denial-of-service
#email
#mime4j
#cve-2026-85111

Posted by Benoit Tellier on Nov 06 Severity: CVSS 4.0: 8.7 (high) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache James before 3.9.1 Description: Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior…

Read the full story at seclists.org ↗

Timeline

Nov 6
Vulnerability disclosed on the Open Source Security list by Benoit Tellier
Nov 6 · 5:03 PM
Open Source Security
CVE-2026-85111: Apache James: Denial of service upon MIME parsing