CVE-2026-85111: Apache James: Denial of service upon MIME parsing

Published Nov 6, 2026

Updated

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.

See CVE-2026-85108 in Apache James MIME4J library.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache James server to a version that resolves this vulnerability.
Fixed in 3.9.1

Event History

Nov 6, 2026

CVE Published

via MITRE·11:50 AM

Data Sourced

via MITRE·11:50 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using an Apache James Mime4J library version earlier than 0.8.15 are affected when they parse MIME messages. Apache James server 3.9.1 relies on the fixed Mime4J 0.8.15 release.

What does an attacker need to do to trigger the issue?

An attacker needs to cause the affected software to parse a MIME message. The issue can result in denial of service because resource allocation is not limited or throttled during MIME parsing.

What is the recommended remediation?

Upgrade to Apache James server 3.9.1, which uses the fixed Apache James Mime4J 0.8.15 version.

CVE-2026-85111: Apache James: Denial of service upon MIME parsing

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to do to trigger the issue?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to do to trigger the issue?

What is the recommended remediation?