CVE-2026-85111 - Vulnerability Details - OpenCVE

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.

See CVE-2026-85108 in Apache James MIME4J library.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://lists.apache.org/thread.html/j1bql696qvg935lp8zo0m626jp9n0h8q
https://www.cve.org/CVERecord?id=CVE-2026-85108

History

Fri, 06 Nov 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue. See CVE-2026-85108 in Apache James MIME4J library.
Title		Apache James: Denial of service upon MIME parsing
Weaknesses		CWE-770
References		https://lists.apache.org/thread.html/j1bql696qvg935lp8zo0m626jp9n0h8q https://www.cve.org/CVERecord?id=CVE-2026-85108
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-11-06T11:50:40.472Z

Updated: 2026-11-06T11:50:40.472Z

Reserved: 2026-09-03T06:57:05.175Z

Link: CVE-2026-85111

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-06T12:17:23.390

Modified: 2026-11-06T12:17:23.390

Link: CVE-2026-85111

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-770

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85111", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-03T06:57:05.175Z", "datePublished": "2026-11-06T11:50:40.472Z", "dateUpdated": "2026-11-06T11:50:40.472Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-06T11:50:40.472Z"}, "title": "Apache James: Denial of service upon MIME parsing", "problemTypes": [{"descriptions": [{"description": "CWE-770 Allocation of resources without limits or throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache James", "packageURL": "pkg:software-id/apache.org/james-server", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache James", "packageURL": "pkg:maven/org.apache.james/james-server", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.1", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.james:james-server"}], "descriptions": [{"value": "Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.\nUsers are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.\n\nSee\u00a0CVE-2026-85108 in Apache James MIME4J library.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.<br>Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.<br><br>See CVE-2026-85108 in Apache James MIME4J library.</div>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/j1bql696qvg935lp8zo0m626jp9n0h8q", "tags": ["vendor-advisory"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-85108", "tags": ["related"]}], "metrics": [{"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Mike Read", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:software-id/apache.org/james-server", "product": "Apache James", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.9.1", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.james:james-server", "packageURL": "pkg:maven/org.apache.james/james-server", "product": "Apache James", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.9.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.\nUsers are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.\n\nSee\u00a0CVE-2026-85108 in Apache James MIME4J library."}], "id": "CVE-2026-85111", "lastModified": "2026-11-06T12:17:23.390", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-11-06T12:17:23.390", "references": [{"source": "[email protected]", "url": "https://lists.apache.org/thread.html/j1bql696qvg935lp8zo0m626jp9n0h8q"}, {"source": "[email protected]", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85108"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "[email protected]", "type": "Primary"}]}