CVE-2026-76171: Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

Published Nov 6, 2026

Updated

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache James server to a version that resolves this vulnerability.
Fixed in 3.9.1

Event History

Nov 6, 2026

CVE Published

via MITRE·11:42 AM

Data Sourced

via MITRE·11:42 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Apache James Server deployments running a version earlier than 3.9.1 are affected where JMAP PushSubscription web-push functionality is in use.

What could exploitation allow?

Improper SSRF validation in the JMAP web-push client can allow requests to reach internal addresses.

What should teams do to remediate the issue?

Upgrade Apache James Server to version 3.9.1, which fixes the SSRF validation issue.

CVE-2026-76171: Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What could exploitation allow?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What could exploitation allow?

What should teams do to remediate the issue?