CVE-2026-85108: Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling

Published Nov 6, 2026

Updated

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache James Mime4J to a version that resolves this vulnerability.
Fixed in 0.8.15

Event History

Nov 6, 2026

CVE Published

via MITRE·11:46 AM

Data Sourced

via MITRE·11:46 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using Apache James Mime4J versions earlier than 0.8.15 to parse MIME messages are exposed. The denial of service occurs during MIME message parsing.

What does an attacker need to exploit it?

An attacker needs to cause a vulnerable Mime4J deployment to parse a MIME message. The provided information does not specify any additional authentication or access requirements.

Are default configurations affected?

The issue is fixed in 0.8.15 by enforcing new limits and providing better defaults, indicating that earlier versions did not provide those protections. The available information does not identify specific affected configuration settings.

What should teams do if they cannot patch immediately?

Upgrade to Mime4J 0.8.15 when possible. The provided information does not specify a supported workaround for earlier versions.

CVE-2026-85108: Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default configurations affected?

What should teams do if they cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default configurations affected?

What should teams do if they cannot patch immediately?